Radiological sources are used throughout the world for medical and industrial purposes. Until the 1950s, only naturally occurring radioactive materials, such as radium-226, were available for use in radiological sources. Since then, sources containing radioactive material produced artificially in nuclear reactors and accelerators have become widely available, including cesium-137, cobalt-60, and iridium-192. Sealed sources vary in size from the size of a grain of rice to rods up to several inches in length. Figure 1 provides an image of an americium-241 sealed radiological source. According to IAEA, the level of protection provided by users of radioactive materials should be commensurate with the safety and security risks that the material presents if improperly used. For example, radioactive materials used for certain diagnostic imaging may not present a significant safety or security risk due to their low levels of activity. However, high-risk sealed radiological sources that contain cobalt-60, cesium-137, or iridium-192 could pose a greater threat to the public and the environment and a potentially more significant security risk, particularly if acquired by terrorists to produce a dirty bomb. Industrial radiological sources are used in, among other things: (1) industrial radiography devices for testing the integrity of welds, (2) well logging devices in oil and gas production, (3) research irradiators in the aerospace sector, and (4) panoramic and underwater irradiators used to sterilize industrial products. NRC oversees licensees through three regional offices located in Pennsylvania, Illinois, and Texas. NRC has relinquished regulatory authority for licensing and regulating radiological sources to 37 Agreement States that have entered into an agreement with NRC. Figure 2 shows which states are overseen by NRC and which are Agreement States. Prior to 2003, NRC did not have specific orders intended to address security, but its safety regulations included general provisions that licensees “secure from unauthorized removal or access” radiological sources in storage, and to “control and maintain constant surveillance” over materials not in storage. Following the attacks of September 11, 2001, NRC determined that certain licensed material should be subject to specific security requirements. The security of radioactive materials, or sources, is a stated top priority for the agency to prevent the use of such sources by terrorists. NRC has issued multiple orders and guidance documents that direct licensees possessing high-risk radiological sources to implement security measures. For the purposes of this report, we refer to these NRC security orders and implementation guidance as “NRC security controls” or “security controls.” NRC’s security controls apply to all types of high-risk industrial radiological sources, including mobile and stationary sources. These security controls include the following: A 2003 security order requiring increased security measures for licensees with panoramic and underwater irradiators. A 2005 security order directing all licensees possessing certain types of radiological materials, including those commonly used in industrial processes, to implement increased security measures, such as conducting employee background checks. Implementation guidance was provided with the security order. Order Imposing Compensatory Measures for All Panoramic and Underwater Irradiators Authorized to Possess Greater than 10,000 Curies of Byproduct Material in the Form of Sealed Sources. NRC Order EA-02-249. A 2007 security order requiring criminal background checks and fingerprinting for individuals needing unescorted access to radiological material for their jobs. Fingerprints are required to be sent to NRC, which forwards them to the FBI for criminal background checks. Implementation guidance was also provided with this order. NRC officials told us that they have adopted a risk-based approach to security in which the level of security should be commensurate with the type and amount of sources that licensees are attempting to protect. According to NRC officials, the intent of the security controls is to develop a combination of people, procedures, and equipment that will delay and detect an intruder and initiate a response to the intrusion—not to provide absolute certainty that theft or unauthorized access will not be attempted, but to recognize and address such efforts should they occur. The security controls provide minimum requirements that must be met to ensure adequate security, and licensees may go beyond the minimum requirements. NRC has recently taken action to codify its security orders and guidance into federal regulation. In March 2012, NRC approved the publication of final regulations to, among other things, establish requirements for security measures for medical and industrial radiological sources into NRC regulations, replacing the existing security orders. The final regulations, found in 10 C.F.R. Part 37 (commonly known as Part 37), were published in the Federal Register in March 2013, and they went into NRC licensees were required to comply with the effect 60 days later.regulations by March 2014, while Agreement States are to promulgate compatible regulations by March 2016, with their licensees being required to comply at a subsequent date determined by each state. The current security orders remain in place until the new regulations are implemented. NRC has also developed and provided licensees with implementation guidance for Part 37.inspections would occur once the new regulations were in effect. NRC officials said that a new round of security In September 2012, medical facilities we visited, NRC’s requirements did not consistently ensure the security of high-risk radiological sources. One reason for this is that the requirements, which are contained in NRC security controls, are broadly written and do not prescribe specific measures that licensees must take to secure their equipment containing high-risk radiological sources. We recommended, among other things, that NRC strengthen its security controls by providing medical facilities with specific measures they must take to develop and sustain a more effective security program, including specific direction on the use of cameras and alarms. NRC disagreed that its security controls needed strengthening through more prescriptive security measures, stating that its approach provides adequate protection and gives licensees flexibility to tailor effective security measures across a wide variety of licensed facilities. we reported that, at the 26 selected hospitals and In contrast to NRC’s flexible approach that allows licensees to determine which security measures to implement to meet the security controls, NNSA’s voluntary program for radiological source security uses a prescriptive approach to upgrade the security of facilities—once a facility agrees to participate—to a level beyond NRC’s minimum requirements. According to NNSA’s physical security guidelines, which were established in 2010, the curie amounts for devices using high-risk radioactive material such as iridium-192, americium-241, and cesium-137 determine the level of protection required. For example, NNSA recommends that facilities using devices containing at least 10 curies of these materials upgrade, at a minimum, the security of doors, locks, windows, walls, and ventilation ducts. By comparison, NRC does not require security controls for some devices containing only 10 curies of iridium-192, americium-241, and In addition, NNSA’s guidelines for 10 curies and above cesium-137. GAO, Nuclear Nonproliferation: Additional Actions Needed to Improve Security of Radiological Sources at U.S. Medical Facilities, GAO-12-925 (Washington, D.C.: Sept. 10, 2012). also call for video cameras, bullet resistant glass, hardened doors, cages, and security grating, and if possible, armed on-site response. For high- risk material totaling at least 1,000 curies, or when multiple smaller sources are located in the same storage facility with a combined curie level of 1,000 curies or more, NNSA recommends biometric access control devices, critical alarm remote monitoring systems, and enhanced barriers to delay an adversary’s pathway to the radiological sources. Challenges exist in reducing the security risks faced by licensees using high-risk industrial radiological sources, even when they follow NRC’s security controls. Specifically, licensees face challenges, in (1) securing mobile and stationary sources and (2) protecting against an insider threat. We identified two main types of industrial radiological sources during the course of our review: mobile sources used for testing pipeline welds in the oil and gas sector, and stationary sources used for, among other things, aerospace research, oil and gas production, and food safety. Some of the stationary sources pose unique security challenges due to either how they are stored or their large curie levels. According to NNSA data, there are approximately 1,400 industrial facilities in the United States that house either mobile or stationary high-risk radiological sources, containing a combined total of approximately 126 million curies of radioactive material. The portability of some industrial radiological sources makes them susceptible to theft or loss. According to NRC, as of December 2013, there are approximately 498 radiography licensees with 4,162 radiological sources in the United States. These sources have a cumulative total of about 214,000 curies of primarily iridium-192 and cobalt-60. In 2007, we reported that IAEA officials said that transportation of high-risk radiological sources is the most vulnerable part of the nuclear and radiological supply chain. Furthermore, according to IAEA documents, the size of some of these mobile sources could make it easier for unauthorized removal by an individual as the source is small enough to be placed into the pocket of a garment. The most common mobile source, iridium-192, is contained inside a small device called a radiography camera. NRC officials said that the device is about the size of a gallon paint can and is transported in specially designed trucks to remote locations where it can remain in the field for days or even months. Figure 3 shows an example of a radiography camera. NRC’s security controls call for two independent physical measures— such as two separate chains or steel cables locked and separately attached to the vehicle—when securing a mobile device containing a high-risk source to a truck. The controls also call for licensees to maintain constant control and/or surveillance during transit, as well as disabling the truck containing such devices when not under direct control and constant surveillance by the licensee. While the controls call for certain security measures, they do not include specific requirements for trucks to have alarm systems or specify the strength or robustness of the locks that must be used to secure the source inside the trucks. The controls also do not include requirements for a Global Positioning System (GPS) on the trucks. All of the 15 facilities we visited had implemented NRC’s security controls according to the licensees and accompanying NRC or Agreement State inspector. In August 2012, a radiography camera containing 81 curies of iridium- 192 was stolen from a truck parked outside of a company’s facility in one state. An individual broke into five trucks, taking various items, including one radiography camera that had been left in one of the trucks rather than being returned to the storage facility. A surveillance camera identified the truck used by the individual, and police recovered the radiography camera from the individual’s residence. Agreement State officials initially proposed fining the licensee $10,000, but the licensee and the state office ultimately settled on a fine of $1,000 to address the administrative penalty. In July 2011, a radiography camera containing 33.7 curies of iridium- 192 was stolen from a truck parked in a hotel parking lot in the same state. Although the door to the truck’s darkroom was locked and the device secured using cables and padlocks, the truck’s alarm system was not activated. During the early morning hours, multiple individuals broke into the truck while it was parked at a motel and ripped the cables securing the container holding the radiography camera out of the wall of the darkroom enclosure. The radiological source was never recovered. The state initially proposed a $5,000 fine for the administrative penalty, but the penalty was reduced to $500 due to the efforts and expenses made by the company to recover the device. In September 2006, a radiography camera with approximately 100 curies of iridium-192 was stolen along with a radiography truck, which was parked at a gas station in the same state. The truck was stolen when the radiographer went into the gas station to talk with his supervisor and left the keys to the truck and the darkroom in the cab of the truck. The truck was recovered 2 days later by the police at a nearby business park along with the radiological source. The state decided not to assess a fine against the company for the administrative penalty, noting that the device was recovered. In August 2006, a radiography camera with approximately 75 curies of iridium-192 was stolen along with a radiography truck from a hotel parking lot in another state. Although the truck was equipped with an alarm, the alarm was not activated. In addition, the radiographer left the vehicle’s keys in the truck’s door. The truck was abandoned and found the next day along with the radiological source by the police in a nearby strip mall parking lot. According to an Agreement State official, they do not have statutory authority to impose monetary fines for security violations, so no fine was assessed. Concerning individuals impersonating safety and security inspectors at remote worksites, according to incident reports we reviewed and state officials we spoke to, we found that: In September 2010, a radiography crew was approached at a temporary worksite by an individual who identified himself as an inspector. The individual became confrontational with the crew and approached the worksite. When the radiographers prevented him from entering the worksite, he accused them of violating proper procedures in their operation. The radiographers asked the individual to provide identification, but he refused and later left the worksite. The individual, who was a licensed radiographer, was identified as having multiple convictions on his record, including assault, forgery, and terroristic threats. The individual no longer practices radiography in the state. In March 2010, radiographers working at a temporary worksite were approached by an individual wearing a jacket with the state logo who identified himself as a safety and security inspector. The individual opened and closed the radiographer’s truck doors, went into the darkroom, and then observed the radiographers as they performed operations. He asked the radiographers questions regarding the amount of curies in the radiography camera. After the radiographers contacted their superior, the individual left with two accomplices and was never apprehended. Two radiography licensees, as well as an Agreement State and several NRC inspectors, told us that the existing security controls were adequate and that the industrial sources they use or monitor were adequately protected. For example, one licensee told us that—given the small size of his company, the company’s limited financial resources, and the marginal risks associated with the radiological sources—additional security requirements were not necessary. In contrast, another Agreement State inspector told us that the security controls should be more prescriptive, as more specific controls would make selecting security measures clearer for licensees and evaluating the adequacy of such measures clearer for inspectors. He said that nonprescriptive controls require additional evaluation to determine if something is acceptable or not. In addition, a senior security official at a large radiography company told us that, prior to the July 2011 theft of the source that was never recovered, he believed that NRC’s security controls were adequate. However, after the source was stolen, he concluded that NRC’s controls needed to be more prescriptive. He told us that the controls are too general, which makes them largely ineffective. This official also said that the current playing field is not level and that some smaller radiography companies are doing a disservice to the radiography industry by installing security measures that meet NRC’s security controls but are generally very weak. He cited several examples of security measures he has seen that he believes are substandard, including cheap locks, ineffective alarms, and darkroom doors that can be easily breached. This official recommended that industrial radiographers install common sense security measures, such as high-security locks, which cost approximately $50 each, reinforced doors, and GPS. In addition, in 2007, the governor of Washington State requested that GPS should be required for licensees with highly radioactive mobile sources. Specifically, in 2006, the theft of a radiography camera in her state prompted the governor to petition NRC to consider requiring GPS for vehicles carrying high-risk sources, such as radiography cameras, or allow states the flexibility to implement more stringent security measures than those required by NRC. In the petition, the governor pointed to a separate incident where a smaller radioactive source in a portable gauge was stolen, but it was quickly recovered due to a GPS tracking feature on the phone of the operator. In response to the petition, NRC informed Washington State that the issues raised in the petition would be considered in the ongoing Part 37 rulemaking. However, in March 2013, NRC denied the petitioner’s request and did not require GPS tracking in the final Part 37 rule. NRC also stated in the Federal Register that, with respect to mobile radiological sources, existing security controls provide adequate protection for mobile devices and that GPS was “neither justified nor necessary.” An official from the Washington State’s Department of Health stated in its response to NRC that his agency was very disappointed that the Part 37 rule did not follow through on the recommendation made by the governor and asserted that GPS tracking is inexpensive and an easy way to help with the rapid recovery of a stolen industrial radiological source should preventative measures fail. Notwithstanding NRC’s decision, some licensees that we met with during the course of our audit have installed GPS on their trucks. Of the 15 industrial radiography companies we visited, 8 had installed GPS on their fleet of trucks. Of these 8 companies, 4 also provided their radiographers with vibrating key fobs to alert them when the vehicle alarm goes off. In the view of the radiographers from these 8 companies, GPS is an effective security control. A senior security official at a large radiography company told us that, after learning about a theft in 2011, his company installed GPS in all 120 of its trucks at a cost of approximately $50 to $100 per installation and from $29 to $39 per truck for monthly service. Securing stationary high-risk radiological sources also poses challenges for licensees. Facilities housing these sources include aerospace manufacturing and research plants, storage warehouses, and panoramic irradiators used to sterilize industrial products. Similar to the mobile sources, NRC’s security controls for stationary sources provide a general framework that is implemented by the licensee. However, as we reported the security controls are broadly written and do not in September 2012,provide specific direction on the use of cameras, alarms, and other relevant physical security measures. The challenge that licensees face as a result of the broadly written security controls is that they may select from a menu of security measures, which allows them to meet NRC’s controls but not necessarily address all potential security vulnerabilities. According to the licensees and inspectors that accompanied us, all of the industrial facilities with Category 1 and Category 2 high-risk radiological sources we visited had measures in place to meet NRC’s security controls, such as locks and motion detectors, and the sources themselves were located within the interior of the building. While these facilities met NRC’s security controls, we noted that some facilities appeared to continue to have certain vulnerabilities. For example, many of the facilities we visited did not have security measures of the type often recommended by NNSA as part of Examples of facilities we visited that their voluntary security upgrades.met NRC’s security controls but still had potential security vulnerabilities include the following: At one facility, we observed that a warehouse storing 25 iridium-192 radiography cameras had an exterior rolltop door that was open and unattended (see fig. 6). Once inside the warehouse, we also observed that the wall acting as one of the barriers to the sources did not go from the floor to the ceiling. When we asked the NRC security inspector who accompanied us about the barrier, the inspector told us that the licensee was in compliance with NRC’s security controls because the sources were secured through other measures—such as locks and a motion detector. The inspector told us that while the security measures in place were not optimal, there were no apparent security violations. At another facility, we observed a cesium-137 irradiator with approximately 800 curies that was on wheels and in close proximity to a loading dock rollup door that was secured with a simple padlock (see fig. 7). The irradiator was stored in a vault that had a reinforced sliding door and a motion detector that was activated after normal working hours. The licensee told us that the wheels on the irradiator were needed to move the device to different parts of the facility when conducting research. During our visit, we observed that the sliding door to the vault—which is one of the security measures used by the licensee—was left open for ease of access. In our September 2012 report, we identified a similar situation at a medical facility and concluded that although the facility met NRC’s security controls, it could be vulnerable because of the limited security we observed and the mobility of the irradiator. We also observed unsecured exterior skylights at a number of warehouses that contained radiological sources ranging from iridium-192 radiography cameras to higher curie levels of cobalt-60 and cesium-137 used for industrial research and manufacturing. Of the 33 industrial facilities we visited, 9 had unsecured skylights. When we questioned an NRC safety and security inspector who accompanied us on the visit about the unsecured skylights, he noted that the licensees met NRC’s security controls because the sources were secured in a locked container, and he said that these skylights did not pose a security vulnerability. Figure 8 shows examples of unsecured skylights. We also identified two types of stationary sources that pose unique security challenges due to (1) how americium-241 sources are currently being stored at some well logging facilities and (2) the large curie levels of cobalt-60 sources found in panoramic irradiators. Well logging is a process used to determine whether a well has the potential to produce oil. Some well logging storage facilities with large amounts of americium-241, including two facilities that we visited, are potentially more vulnerable to theft as they have not implemented NRC’s security controls. Under NRC’s security controls, increased security measures are triggered by the type and amounts of curies of radiological sources. For example, licensees with americium-241 are required to implement NRC’s security controls when the radiological sources in their possession total 16 curies or more. Under the security controls, multiple sources of the same type are added together for regulatory purposes only if they are “collocated.” NRC considers these sources to be collocated if someone could gain access to them by breaching a single physical barrier. However, some well logging licensees do not come under NRC’s security controls because they separate their americium-241 into quantities that are not considered collocated. For example, these licensees may store quantities of this source in multiple separately locked containers, which function as barriers, so they do not meet the definition of being collocated. Figure 9 shows an example how licensees could store americium-241 in separate containers that would not be considered collocated, and therefore, not under NRC’s controls. As a result, a segment of facilities with large quantities of radiological sources falls outside of NRC’s increased security controls, including security inspections for the increased controls.identified the security of radioactive sources as a top agency priority to prevent the use of such sources by terrorists. Thus, NRC’s definition of collocation may have the unintended consequence of placing a segment of these sources at greater risk of theft or loss. Licensees of mobile and stationary radiological sources face challenges in determining which of their employees are suitable for trustworthiness and reliability (T&R) certification, as required by NRC’s security controls.Such certification allows for unescorted access to high-risk radiological sources. Officials at almost half of the facilities we visited told us that they face challenges in making T&R determations. These challenges include limited security experience and training and incomplete information to determine an employee’s suitability for unescorted access. Before a licensee can grant an employee unescorted access to high-risk radiological sources, NRC security controls require the licensee, among other things, to: (1) conduct employment and education background checks; (2) perform an identification and criminal history check that includes taking the employee’s fingerprints and sending them to NRC, which forwards the fingerprints to the FBI; and (3) determine that the individual is trustworthy and reliable. These controls are intended to mitigate the risk of an insider threat—an employee or someone else with authorized access who might be trying to steal, tamper with, or sabotage radiological sources. NNSA officials told us that they consider an insider threat to be the primary threat to facilities with radiological sources. According to an NNSA Fact Sheet, almost all known cases of theft of nuclear and radiological material involved an insider. The document states that skills, knowledge, access, and authority held by some insiders make the threat difficult to mitigate. As a result, great care must be taken in determining the T&R of employees who are granted unescorted access in facilities with high-risk radiological sources. Under NRC’s security controls, the criminal history check is performed by the FBI, submitted to NRC, and forwarded to the licensee. NRC’s controls place the responsibility on the licensee to evaluate all the information and determine whether the employee is trustworthy and reliable. In its Part 37 regulations, NRC codified the process for criminal history check and review generally as established in the orders. In response to its proposal for these regulations, NRC received comments stating that it should provide specific criteria—such as disqualifying convictions—for use by licensees with respect to the T&R determination. However, NRC declined to provide specific criteria, stating that it is the licensee’s responsibility to consider all information and make a determination. An NRC official told us that this was a policy choice by the Commission. The official said that NRC’s role in the T&R determinations is limited, but NRC inspectors may review a licensee’s records during a site inspection. However, the official told us that such a review is limited to whether the licensee obtained the required types of information, not the merits of the licensee’s determination to grant unescorted access to an individual. NRC has provided licensees with a number of indicators to consider when evaluating an individual’s T&R. Some of these include the following: conduct that warrants referral for criminal investigation or results in arrest or conviction; uncontrolled anger, violation of safety or security procedures, or attempted or threatened destruction of property or life; and the frequency and recency of the conduct. NRC implementation guidance states that these indicators are not meant to be all inclusive or be disqualifying factors. Moreover, NRC’s guidance states that it is a licensee’s business decision as to what criteria it uses for the basis of the T&R determination. NRC guidance—as well as its new regulations—does not specify how a licensee should evaluate an individual’s T&R. For example, NRC’s current and former implementation guidance do not include indicators that would disqualify an employee from receiving unescorted access. Instead, each case must be judged on its own merits, and final determination remains the responsibility of the licensee. NRC’s implementation guidance also states that the requirements are not intended to stop determined adversaries intent on malevolent action from gaining access to the radioactive sources. Rather, this implementation guidance is designed to provide reasonable assurance that individuals with unescorted access to the radiological sources are trustworthy and reliable and that facilities have a reliable means to monitor events that are potentially malevolent and have a process for prompt police response. Under NRC’s security controls, it is left to the licensee to decide whether to grant unescorted access, even if an individual has been indicted or convicted for a violent crime or terrorism, and the licensee is not required to consult with NRC before granting T&R access. Officials at 7 of the 33 licensees we reviewed said that they have granted unescorted access to high-risk radiological sources to individuals with criminal histories. We found two cases where employees of industrial radiographers in two different states were granted unescorted access despite having serious criminal records. Case 1: Individual with numerous criminal convictions. In one case, a T&R official told us that she granted unescorted access to an individual in 2008 with an extensive criminal history, some of which was included on the FBI report the company received from NRC, and some that was absent. This criminal history included two convictions for terroristic threat that occurred in 1996, which were not included in the background information provided to the T&R official by NRC. While NRC’s security orders do not preclude granting unescorted access to radiological sources to persons with convictions for terroristic activity (or other serious crimes), the T&R official said that had she been aware of the individual’s convictions for terroristic threat, she would not have granted him unescorted access. Based on available documents, we identified that the individual had been arrested and convicted multiple times between 1996 and 2008. These convictions included the following: terroristic threat (twice), assault, forgery, failure to appear in court, driving while intoxicated, and driving with a suspended license. According to that state’s statute, a terroristic threat includes any offense involving violence to any person or property with intent to, among other things: place the public or a substantial group of the public in fear of serious bodily injury; place any person in fear of imminent serious bodily injury; or prevent or interrupt the occupation or use of a building, place of assembly, place of employment or occupation, aircraft, automobile, or other form of conveyance. According to NRC officials, identification of a criminal history through the FBI or a discretionary local criminal history check does not automatically indicate unreliability or untrustworthiness of an individual. The licensee may authorize individuals with criminal records for unescorted access to radioactive materials notwithstanding the individual’s criminal history. In 2010, the individual was declared to be a substantial threat by the Agreement State’s licensing agency after he impersonated a radiography inspector and was hostile toward radiographers in the field, as previously discussed. An investigation performed by the state health department concluded that the individual was a threat to public health and safety, and he subsequently surrendered his state radiography license. It was not clear from available information why the terroristic threats and other convictions did not appear on the FBI criminal background check or why the official deemed the individual trustworthy and reliable. We brought this case to NRC’s attention after learning about it in February 2014. In response, NRC officials said that they contacted the Agreement State office to gather relevant information and independently evaluate whether the situation represented an isolated incident or if it was indicative of a programmatic issue. Based on their initial review, the officials said that they believed the event was an isolated incident. However, without an assessment of the T&R process, NRC will not be able to determine the extent to which this case may represent a larger problem or if corrective actions are needed. Case 2: Individual caught stealing from company. In another case, an industrial radiographer in charge of making T&R determinations told us that an individual with an extensive criminal record was granted unescorted access to radiological sources. The T&R official told us that he considered the individual a risk and objected to granting him unescorted access, but he was overruled by his supervisor. The employee who had been granted access was subsequently arrested for stealing from the company. Without more complete information and specific guidance on how to evaluate an individual’s T&R, licensees could continue to face challenges in making decisions about the suitability of personnel who are granted unescorted access to high-risk radiological sources, elevating the risk of an insider threat, which NNSA has identified as being responsible for almost all known cases of theft of nuclear and radiological material. As noted above, NRC’s approach to providing reasonable assurance to an insider threat is to require licensees to collect and to consider various types of information, including an FBI criminal history, and to make a determination based on the licensee’s judgment, without any NRC- identified disqualifying criteria. Therefore, nothing in the NRC controls or guidance precluded the licensees in these two examples from approving access. Moreover, according to an NRC official, NRC’s role is limited to providing guidance and inspecting that the licensee has accumulated all appropriate information when making T&R determinations—not the merits of any particular decisions. Federal agencies are taking steps to better secure industrial radiological sources. Specifically, NRC is developing a Best Practices Guide for licensees of high-risk radiological sources and planning to provide additional training to NRC inspectors. In addition, NNSA has two initiatives under way to improve industrial radiological source security. However, NRC, NNSA, and DHS—agencies that play a role in nuclear and radiological security—are not effectively collaborating to achieve the common mission of securing mobile industrial sources. NRC plans to develop a Best Practices Guide for licensees of high-risk radiological sources in response to a recommendation in our September 2012 report. According to NRC officials, the guide is expected to be issued in spring 2014 and will include information for licensees on physical barriers; locks; monitoring systems, such as cameras and alarms; as well as examples of how to secure mobile sources and sources in transit. NRC officials told us that the guide will serve as a layperson’s source of practical information about security and have minimal technical language. However, the Best Practices Guide remains in draft form, and it is not clear that it will provide specific direction on cameras, alarms, and other relevant physical security measures. For example, the officials said that the guide will not be a catalogue for specific makes and models of security devices such as cameras and locks. During development of the Best Practices Guide, an NRC official told us that they are relying on a working group that includes, among others, representatives from NNSA, four inspectors from NRC’s regional offices, one Agreement State inspector, and one Agreement State manager to provide insight into challenges licensees face in complying with NRC’s security controls. However, the official also told us that they have not directly reached out to licensees during the development of the Best Practices Guide. NRC data show that there are almost 800 industrial licensees in the United States. As we reported in 2013, active engagement with program stakeholders is a critical factor to success. Furthermore, in 2012, we reported that programs are most likely to succeed when they involve stakeholders in establishing shared expectations for the outcome of the process. According to professional practices, project managers should identify and prioritize stakeholders to include those who will be directly affected (positively and negatively) by the project. Once the stakeholders are identified, continuous communication is needed to ensure that their needs are understood, issues are addressed as they come up, and they are engaged in the project decisions and activities. Although developing the guide is a step in the right direction, without including the views of licensees, NRC cannot be certain that the guide will be as useful as it could for those who will be directly affected by the process. NRC also plans to provide additional security training for NRC and Agreement State inspectors to improve security awareness and reinforce a security culture. For example, NRC began revising the inspector training course in May 2013 and moved the training facility from Sandia National Laboratories to the NRC Technical Training Center in Chattanooga, TN. NRC officials told us that the course will provide information on physical protection systems and NRC security controls, including the identification of threats, an introduction to physical protection systems, and the identification of critical components of physical security, such as detection and access control. NRC officials also said that they have built a mock security laboratory at the Technical Training Center, which includes examples of security equipment such as security sensors, alarms, locks, and cameras. In addition, NRC plans to take inspectors on facility tours to introduce them to security practices at an irradiator site that has installed the voluntary NNSA security upgrades, a small mobile radiography company, and a local emergency response center. NNSA has two initiatives under way to address security risks posed by industrial radiological sources: (1) testing and developing tracking technology for mobile sources, and (2) upgrading the physical security of industrial facilities. Testing and developing technology for tracking mobile sources. In 2013, NNSA officials reported spending approximately $800,000 for a project to develop tracking systems for mobile devices containing radiological sources. Under cost-sharing arrangements, NNSA officials told us that they are collaborating with industry partners from both the industrial radiography and well logging industries who have agreed to provide support for development, design reviews, and field testing of prototype systems. According to the officials, this technology, if successful, would allow for (1) real-time tracking and monitoring of the source in storage, during transport, and during temporary storage within the transport vehicle, (2) immediate notification of a potential loss or theft situation to a central monitoring location, and (3) assistance in recovering a source that is lost or stolen. NNSA officials said that they plan to complete the development of the tracking systems and transfer the technology to one or more vendors for commercial manufacture and sale by summer 2015. Individual industrial radiography and well logging companies would be able to purchase the systems directly from the commercial manufacturer. To encourage use of the technology, NNSA is also evaluating if the government should subsidize all or a portion of the cost of the systems and, if so, for all potential users, or a particular group of users meeting certain criteria. NNSA officials told us that they expect the systems to cost in the range of $300 to $500 for each radiography device, and $500 to $750 for each well logging truck. Security upgrades at facilities. As of June 2013, NNSA had completed security upgrades at 20 industrial facilities at a cost of $5.5 million. Included in the 20 industrial facilities with completed upgrades are 7 USDA sites with irradiators containing cobalt-60 and cesium-137 that are used for research and pest irradiation. Upgrade of these 7 facilities cost $3.8 million. NNSA has also completed security upgrades at one mobile radiography facility but, according to NNSA officials, the agency decided not to upgrade any additional facilities because higher priority facilities were scheduled for completion first. In addition, NNSA officials said that their current plans are to complete the development of the electronic mobile source tracking system prior to implementing security upgrades at additional radiography storage facilities. They told us that security at storage facilities for mobile sources would only address half the risk, as the sources also travel into the field. NNSA’s activities include working with federal, state, and local agencies, as well as private industry to install sustainable security enhancements for high-priority nuclear and radiological materials located at civilian sites in the United States. However, an NNSA official told us that, in light of their available funds for these efforts, many of these civilian sites with industrial radiological sources have not received security upgrades, and it is uncertain when or if such upgrades will be made. To date, NNSA has focused most of its attention and planning—and expended the majority of available funds for making such upgrades—on U.S. medical facilities. As of June 2013, NNSA had completed security upgrades at approximately one-quarter of all U.S. hospitals and medical facilities with high-risk radiological sources at a total cost of $135 million. NNSA officials said that the agency’s focus on medical facilities is due primarily to the large number of facilities that, in their view, pose a more immediate risk because they are located in and around urban areas, contain large quantities of high-risk sources, and include buildings that are generally more accessible to the general public. However, these officials said that, as the number of medical facilities left to upgrade decreases, the program has begun to focus on industrial facilities and is finding that these facilities (particularly in the panoramic irradiation, industrial radiography, and well logging industries) may require unique security solutions and an updated budget estimate. Although DHS, NNSA, and NRC have an interagency mechanism for collaborating on, among other things, radiological security, they were not always doing so effectively. By not having effective ways to ensure consistent collaboration, the agencies may be missing opportunities to achieve the common mission of securing radiological sources. Our previous work has identified that when responsibilities cut across more than one federal agency—as they do for securing industrial radiological sources—it is important for agencies to work collaboratively. Taking into account the nation’s long-range fiscal challenges, we noted that the federal government must identify ways to deliver results more efficiently and in a way that is consistent with its multiple demands and limited resources. In addition, we have previously reported on the need for collaboration in securing radiological sources. For example, we reported in 2007, that while DOE has improved coordination with the Department of State and NRC to secure radiological sources worldwide, DOE has not always integrated its efforts efficiently, and coordinated efforts among the agencies have been inconsistent. During this review, we found that the agencies involved in securing radiological sources—DHS, NNSA, and NRC—meet quarterly, along with the FBI, for “trilateral” meetings that include, among other things, discussions of radiological security. However, these meetings did not help DHS, NNSA, and NRC collaborate and draw on each agency’s expertise during research, development, and testing of new technology for a mobile source tracking device. Specifically, we found that DHS contracted with Sandia National Laboratories in October 2011 to study commercially available technologies for tracking mobile radiological sources.of the study was $271,000. The study concluded that it is physically possible to tag some radiography and oil well logging devices. However, existing technology such as GPS—as opposed to developing a new technology—has limitations that would prevent reliable or effective tracking. DHS collaborated with NRC and several DOE national laboratories to develop the study but did not share the results with key NNSA officials who are directly involved in radiological source security. According to DHS officials, they made NNSA aware of the report through their quarterly meetings of senior officials, but NNSA officials with responsibility for securing radiological sources told us that they were not aware of the report until we brought it to their attention during the course of our review. NNSA officials told us that it would have been helpful to have the report earlier. As a result, the officials had to quickly evaluate the report’s findings to ensure there were no “show stoppers” that would negatively impact their current activities in the same area of technology development. The cost NNSA is also developing a tracking system for devices containing mobile radiological sources, such as industrial radiography cameras. However, we found that NNSA has not been collaborating with DHS and NRC on the project. For example, NNSA did not reach out to DHS for input regarding tracking technologies, even though DHS had completed a related study in 2011 concerning tracking mobile radiological sources (see above). Regarding NRC, NNSA officials told us that they have no plans to coordinate with the NRC division in charge of regulating and licensing radiological sources—the division that has regulatory authority for radiological security. NNSA officials stated that they would reach out to the NRC technical division that approves and certifies changes in the design of the packaging and transportation of the device. However, the officials noted that coordination would only occur if NNSA determined that recertification of the device is required, which they believed was not likely. As we have previously found, collaborating agencies should identify the human, information technology, physical, and financial resources needed The current collaboration to initiate or sustain their collaborative effort.mechanism employed by DHS, NNSA, and NRC appears to not always be effective, and it may contribute to missed opportunities to leverage resources, including expertise, in developing new technology to address vulnerabilities associated with radiological sources while in transit. Federal agencies are taking steps to better secure industrial radiological sources in the United States. Nevertheless, we found that licensees still face challenges in securing these sources. NRC is developing a Best Practices Guide to reduce the risks posed by the sources and thus help inform and educate licensees and other stakeholders about measures that could be taken to raise the level of security awareness and improve security. While this is a positive step, NRC has not directly reached out to licensees to obtain their views. Active engagement with key stakeholders is a leading practice on which we and others have reported. Without including the views of licensees, NRC cannot be certain that the guide will be as useful as it could for those who will be directly affected by the process. NRC requires security controls for radiological sources commensurate with the type and amount of sources that licensees are attempting to protect. However, some well logging licensees do not come under NRC’s increased security controls, because they separate their americium-241 into quantities that do not meet NRC’s definition of collocation. Because these facilities fall outside of NRC’s increased security controls, they do not receive security inspections for the increased controls. As a result, a segment of these sources are potentially at greater risk of theft or loss. In addition, licensees are required to make T&R determinations regarding employee suitability to have unescorted access to high-risk radiological sources. Under NRC’s security controls, even if an individual has been indicted or convicted for a violent crime, the licensee is not required to consult with NRC before granting unescorted access to high-risk sources. It is unclear whether two cases where employees were granted unescorted access, even though each had extensive criminal histories— including, in one of the cases, convictions for terroristic threats— represent isolated incidents or a systemic weakness in the T&R process. Without an assessment by NRC, the agency may not have “reasonable assurance” that the process in place to make access decisions is as robust as it needs to be to prevent the theft or diversion of high-risk radiological sources by a determined insider. NRC’s security controls are also silent on what, if any, indicators would disqualify an employee from being granted unescorted access. Without more complete information and specific guidance on how to evaluate T&R, licensees could continue to face challenges in making decisions about the suitability of personnel who are granted unescorted access to high-risk radiological sources, potentially increasing the risk of an insider security threat, which NNSA has identified as being responsible for almost all known cases of theft of nuclear and radiological material. As we have reported in the past, it is important for agencies to work collaboratively to achieve greater efficiency. An interagency mechanism exists to promote collaboration among the agencies responsible for securing radiological sources. However, DHS, NRC, and NNSA have missed the opportunity to leverage resources, including expertise, in developing a new technology to track radiological sources, which could aid in the timely recovery of a lost or stolen radiological source and support the agencies’ common mission. We are making four recommendations in this report. To ensure that the security of radiological sources at industrial facilities is reasonably assured, we recommend that the Chairman of the Nuclear Regulatory Commission take the following three actions: Obtain the views of key stakeholders, such as licensees, during the development of the Best Practices Guide to ensure that the guide contains the most relevant and useful information on securing the highest risk radiological sources. Reconsider whether the definition of collocation should be revised for well logging facilities that routinely keep radiological sources in a single storage area but secured in separate storage containers. Conduct an assessment of the T&R process—by which licensees approve employees for unescorted access—to determine if it provides reasonable assurance against insider threats, including determining why criminal history information concerning convictions for terroristic threats was not provided to a licensee during the T&R process to establish if this represents an isolated case or a systemic weakness in the T&R process; and revising, to the extent permitted by law, the T&R process to provide specific guidance to licensees on how to review a employee’s background. NRC should also consider whether certain criminal convictions or other indicators should disqualify an employee from T&R or trigger a greater role for NRC. To better leverage resources, including expertise, to address vulnerabilities associated with radiological sources while in transit, we recommend that the Administrator of NNSA, the Chairman of NRC, and the Secretary of DHS review their existing collaboration mechanism for opportunities to enhance collaboration, especially in the development and implementation of new technologies. We provided a draft of this report to the Chairman of the NRC, the Administrator of NNSA, and the Secretary of Homeland Security for review and comment. NNSA and NRC provided written comments on the draft report, which are presented in appendices II and III, respectively. DHS did not provide comments. NRC generally agreed with our four recommendations, and NNSA agreed with the one recommendation directed to it to enhance collaboration with other federal agencies on the development and implementation of new technologies. In its written comments, NNSA also said that it is ready to support NRC efforts with technical expertise and other assistance as required in relation to the recommendations directed toward NRC. NRC and NNSA also provided technical comments that we incorporated as appropriate. In addition, the Organization of Agreement States, which represents the 37 Agreement States responsible for overseeing regulatory compliance for radiological sources, provided technical comments. In its written comments, NRC stated that the security and control of radioactive sources is a top priority and that its regulations provide a framework that requires licensees to develop security programs with measures specifically tailored to their facilities. NRC also noted that its inspectors have already investigated and taken action on some of our concerns identified in the report regarding the use of industrial sources, and if additional measures are needed, it will consider appropriate enhancements. NRC agreed with our recommendations to (1) obtain the views of stakeholders during development of its Best Practices Guide and (2) enhance collaboration with other federal agencies on the development and implementation of new technologies. NRC also acknowledged the merits of the two other recommendations to reconsider the definition of collocation for well logging facilities and conduct an assessment of the Trustworthiness and Reliability (T&R) process and discussed the actions it plans to take to address them. Regarding these two recommendations, NRC plans to reevaluate these issues as part of its review of the effectiveness of the recently issued security regulations under 10 C.F.R. Part 37. This review is expected to occur 1 to 2 years after the regulations are implemented. According to NRC’s comment letter, this review will serve as the basis for determining whether any additional security measures, guidance documents, rulemaking changes, or licensee outreach are appropriate. To that end, NRC stated in its technical comments that it independently evaluated the case we identified of an individual granted unescorted access, even though he had an extensive criminal history and had been convicted for terroristic threats. Based on its intial review, NRC noted that the event was an isolated incident and not a programmatic issue. However, without an assessment of the T&R process, which they have agreed to consider, NRC will not be able to determine the extent to which this case may represent a larger problem or if corrective actions are needed. We recognize that a review of the effectiveness of the recently issued regulations will take time to complete. However, due to the serious nature of the security problems identified in our report, this reevaluation of the definition of collocation and the T&R process should be conducted by NRC with a greater sense of urgency. If NRC follows its current plan to address these recommendations in the time frame outlined in its comment letter, the review will not occur until 1 to 2 years after implentation of 10 C.F.R. Part 37. In the case of the 37 Agreement States, the earliest the review would occur is 1 to 2 years afer they issue their own compatible regulations—required by March 2016. The longer it takes for licensees to implement the security upgrades, the greater the risk that potentially dangerous radiological sources remain vulnerable and could be used as terrorist weapons. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Administrator of NNSA, the Chairman of the Nuclear Regulatory Commission, the Secretary of Homeland Security, the appropriate congressional committees, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions concerning this report, please contact me at (202) 512-3841 or trimbled@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in appendix IV. We focused our review primarily on the Nuclear Regulatory Commission (NRC) and the Department of Energy’s (DOE) National Nuclear Security Administration (NNSA) because they are the principal federal agencies with responsibility for securing radiological material at industrial facilities in the United States. We also performed work at the Department of Homeland Security (DHS) because they are also involved in securing radiological sources, and we interviewed officials with responsibility for radiological security at the Department of Transportation (DOT) and United States Department of Agriculture (USDA). In addition, we interviewed an expert in the field of nuclear security, representatives from state government, and safety and security personnel at U.S. industrial facilities to discuss their views on how radiological sources are secured. We visited 33 industrial facilities in California, Colorado, Hawaii, Pennsylvania, Texas, and Wyoming. These facilities included 15 industrial radiography companies, 6 commercial or sterilization companies, 5 academic research facilities, 3 well logging companies, 2 manufacturing and distribution companies, and 2 USDA facilities. The 33 facilities we visited are a nongeneralizable sample, selected on the basis of whether they were NRC states or Agreement States, the amount of curies contained in the devices using radiological sources, and the types of radiological devices. In addition, we considered if the site had undergone security upgrades funded by NNSA, and whether the site is located in a large urban area. At each location, we interviewed facility staff responsible for implementing procedures to secure the radiological sources, including questions about the use of security measures and if the licensee had made contact with NNSA. We also met with security personnel at sites, when available, and spoke to officials at some local law enforcement agencies responsible for security breaches. We used NNSA’s G-2 database, which aggregates data from NRC’s National Source Tracking System (NSTS), to identify the location of industrial radiological sources, determine the different types of industrial devices that use radiological sources, and quantify curie amounts for different types of radiological sources. The G-2 data is based on information extracted from the NRC’s 2011 NSTS database, the NRC’s 2008 Sealed Source Inventory, and NNSA project team visits. G-2 contains all buildings in the United States that have risk-significant radiological sources (> 10 curies). To determine the reliability of these data, we conducted electronic testing and interviewed staff at NNSA and NRC about the reliability of these data. We tested these data to ensure their completeness and accuracy, and we determined that these data were sufficiently reliable to use in selecting locations to visit and summarizing the total number of facilities and the total number of curies. To evaluate the challenges industrial licensees with industrial radiological sources face in securing these sources, we reviewed laws, regulations, and guidance related to the security of industrial radiological sources. We interviewed agency officials at NRC, NNSA, DHS, DOT, and USDA. We also interviewed state government officials in three states, and safety and security personnel at 33 industrial facilities we visited in six states, to obtain their views on how radiological sources are secured and what challenges they face in securing them. To identify thefts and incidents involving radiological sources, we reviewed relevant documentation and spoke to federal and state officials. We also spoke to officials at 33 industrial facilities we visited in California, Colorado, Hawaii, Pennsylvania, Texas, and Wyoming. At the facilities, we observed the security measures in place and spoke to officials in charge of implementing NRC and Agreement State security controls and overseeing the security measures. To learn what steps federal agencies are taking to ensure radiological sources are secured at industrial facilities, we obtained information from and interviewed agency officials at NRC, NNSA, DOT, DHS, and USDA who are involved in securing sources and undertaking studies evaluating technologies related to source security. We also obtained information from Agreement States and NRC regions by reviewing documentation and interviewing officials at four Agreement States (California, Colorado, Texas, and Washington State) and one NRC regional office (Region IV) with responsibility for overseeing high-risk radiological sources. We selected these states and the NRC region based on the amount of curies and number of devices in the state containing radiological sources and the types of devices used. We also interviewed officials at DOE’s Pacific Northwest National Laboratory about the status of efforts made to strengthen remote tracking of mobile devices containing radiological sources. We visited industrial facilities that received NNSA funded upgrades and security assessments in California, Hawaii, and Pennsylvania. To determine the costs of NNSA’s security upgrades for industrial facilities, we obtained cost data from NNSA and interviewed the agency official who manages NNSA’s Global Threat Reduction Initiative program. These data were used to determine the number of U.S. industrial facilities that have received NNSA security upgrades, as well as the total cost for completing these upgrades. We discussed the reliability of these data with knowledgeable NNSA officials and questioned them about the system’s controls to verify the accuracy and completeness of the data. We also analyzed these data for missing information and obvious outliers. We found the data sufficiently reliable for our reporting purposes. We conducted this performance audit from November 2012 to June 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the individual named above, Glen Levis (Assistant Director); Jeffrey Barron; Elizabeth Beardsley; Randy Cole; John Delicath; James Espinoza; Karen Keegan; Rebecca Shea; and Kiki Theodoropoulos made key contributions to this report.

Summary: In 2012, GAO identified security weaknesses at U.S. medical facilities that use high-risk radiological sources, such as cesium-137. This report addresses potential security risks with such sources in the industrial sector. Radioactive material is typically sealed in a metal capsule called a sealed source. In the hands of a terrorist, this radioactive material could be used to construct a “dirty bomb.” NRC is responsible for licensing and regulating the commercial use of radiological sources. NNSA provides voluntary security upgrades to facilities with such sources. GAO was asked to review the security of sources at industrial facilities. This report examines (1) the challenges in reducing security risks posed by industrial radiological sources and (2) the steps federal agencies are taking to improve security of the sources. GAO reviewed relevant laws, regulations, and guidance; interviewed federal agency and state officials; and visited 33 of about 1,400 U.S. industrial facilities selected based on, among other things, geographic location and type of device using the radiological source. GAO found that challenges exist in reducing the security risks faced by licensees using high-risk industrial radiological sources. Specifically, licensees face challenges in (1) securing mobile and stationary sources and (2) protecting against an insider threat. Regarding mobile sources, their portability makes them susceptible to theft or loss, as the size of some of these sources is small enough for them to be easily concealed. The most common mobile source is contained in a device called a radiography camera. GAO identified four incidents from 2006 to 2012 where such cameras that use high-risk sources to test pipeline welds were stolen. These thefts occurred even though the Nuclear Regulatory Commission (NRC) has established increased security controls. Licensees also face challenges in determining which employees are suitable for trustworthiness and reliability (T&R) certification to have unescorted access to high-risk radiological sources. GAO found two cases where employees were granted unescorted access, even though each had extensive criminal histories, and one had been convicted for terroristic threats, which include a range of violent threats. In this case, NRC said that the person was convicted not of a threat against the United States, but of making violent verbal threats against two individuals. It is unclear whether these cases represent isolated incidents or a systemic weakness in the T&R process established by NRC. Without an assessment of the process, NRC may not have reasonable assurance that access decisions made by licensees can prevent threats to high-risk radiological sources, particularly by a determined insider. Federal agencies responsible for securing radiological sources—including NRC, the National Nuclear Security Administration (NNSA), and the Department of Homeland Security (DHS)—have taken steps to improve the security of industrial radiological sources. For example, NRC is developing a best practices guide that is expected to provide licensees with practical information about how to secure their sources. Also, NNSA is developing new technology that would, if successful, improve tracking of radiological sources while in transit. However, GAO found that although the agencies have been meeting quarterly to discuss, among other things, radiological security, this mechanism did not always help them collaborate and draw on each agency's expertise during research, development, and testing of a new technology for a mobile source tracking device. By not collaborating consistently, the agencies have missed opportunities to leverage resources and expertise in developing this new technology to track radiological sources. This technology could aid in the timely recovery of a lost or stolen radiological source and support the agencies' common mission. As GAO has previously reported, when responsibilities cut across more than one federal agency—as they do for securing industrial radiological sources—it is important for agencies to work collaboratively to deliver results more efficiently and in a way that is consistent with the federal government's multiple demands and limited resources. GAO recommends, among other things, that NRC assess the T&R process to determine if it provides reasonable assurance against insider threats. In addition, GAO recommends that NNSA, NRC, and DHS review their collaboration mechanism for opportunities to enhance it, especially in the development of new technologies. NRC generally agreed with GAO's recommendations, and NNSA agreed with the one recommendation directed to it. DHS did not comment on the report.