Radiological material is used throughout the world for medical and industrial purposes. Possession of this material within the United States requires a license from NRC or from one of the 37 Agreement States to which NRC has relinquished regulatory responsibility. NRC and Agreement States issue two types of licenses authorizing the possession and use of radiological materials: specific licenses and general licenses. Specific licenses are issued for devices that typically contain larger quantities of radiological material, such as medical equipment used to treat cancer, cameras used for industrial radiography, and moisture and density gauges used in construction. Devices approved for use under a general license, by contrast, such as luminous exit signs, normally contain relatively small quantities of radiological material. Such devices are designed with inherent safety features, are widely available commercially, and do not require NRC or Agreement State approval to possess. Not all radiological material requires an NRC license for possession. For example, there is naturally occurring radioactive material in ceramics, fertilizers, and granite tile that does not require a license. This report focuses on radiological material that requires specific licenses for possession and use. Beyond requiring specific licenses for possession of radiological material, NRC may also require a general or specific license to import such material. Generally, NRC will issue an import license when the recipient of the material is authorized to receive and possess the material being imported. When issuing licenses for the possession of radiological material, NRC and Agreement States take steps to ensure companies are legitimate. Specifically, NRC and Agreement State officials are to conduct pre- licensing visits with all unknown applicants, using detailed screening criteria. According to NRC, the purpose of the site visit is to have a face- to-face meeting with the applicant to determine whether there is a basis for confidence that the applicant will use the radiological materials sought as represented in the application when the applicant receives the license. NRC has established a 14-point checklist to guide pre-licensing site visits and has developed a list of questions and activities related to each applicant’s business operations, facility, radiation safety operations, and personnel qualifications, to scrutinize the applicant and provide a basis for confidence that the applicant will use the radiological material as specified in the license. In 2003, the International Atomic Energy Agency published a system— which NRC adopted in 2004—that ranks quantities of individual radionuclides into one of five categories on the basis of their potential to harm human health. Under this system, a given radionuclide is considered dangerous when gathered in sufficient quantity and in close enough proximity to people to cause direct human health effects. A category 1 quantity, if not safely managed or securely protected, is likely to cause permanent injury to a person who handles or is otherwise in contact with it for more than a few minutes. Being close to this amount of unshielded material for a period of a few minutes to an hour will probably be fatal. A category 2 quantity, if not safely managed or securely protected, can cause permanent injury to a person who handles or is otherwise in contact with it for a short time (minutes to hours). Being close to this amount of unshielded radioactive material for a period of hours to days can be fatal. A category 3 quantity, if not safely managed or securely protected, can cause permanent injury to a person who handles or is otherwise in contact with it for some hours. Being close to this amount of unshielded radioactive material for a period of days to weeks can be fatal. Category 4 and 5 quantities are unlikely to cause permanent injury. In addition to categorizing radionuclides on the basis of their potential to harm human health, NRC has identified 16 radionuclides that are sufficiently attractive for use in a dirty bomb or for other malicious purposes. These 16 radionuclides of concern, shown in table 1, warrant enhanced security and protection measures—such as cameras, alarms, and other physical security measures—under NRC regulations. Radiological material is imported into the United States by both express consignment couriers arriving by air and air cargo carriers. Express consignment couriers, such as FedEx, move cargo for the public under express commercial services and provide door-to-door delivery. Air cargo carriers transport radiological material in cargo containers on commercial airlines. We have previously reported on the disparity in portal monitor deployment between the express consignment and air cargo environments. There are dozens of portal monitors in U.S. airports servicing express couriers, but few servicing air cargo carriers. According to CBP officials, handheld monitors are used to scan radioactive material at airports where portal monitors are not available. The CBP mission includes the border enforcement of the customs, immigration, and agriculture laws and regulations of the United States and enforcement on behalf of numerous federal agencies. The mission includes enforcement of the laws relating to the importation and exportation of merchandise into and out of the United States. In addition, the agency’s mission includes denying entry to terrorists and their weapons and criminals and their contraband. CBP’s Office of Field Operations is responsible for passenger and cargo processing activities related to border security, trade, immigration, and agricultural inspection at the nation’s air, sea, and land ports of entry. Prior to importing goods into the United States, information is submitted to CBP declaring the contents of shipments. This information includes, among other things, a description of goods, the name of the recipient, the port of entry, and a tariff code that classifies goods. CBP uses various data systems to track shipments into the United States and identify shipments for license verification. According to CBP, the Automated Commercial Environment is the primary system for processing shipments entering the United States, and it enables the government to make determinations about whether to admit goods into the country. The data stored in the Automated Commercial Environment are also used to ensure proper duty is collected for imported goods. CBP officials also view Automated Commercial Environment data in CBP’s Automated Targeting System, which is a decision support tool that analyzes shipment data to assess risk and identify potential violations. The Automated Targeting System includes automated alerts, which notify CBP officials when they need to take additional actions before shipments can be released. Information about NRC and Agreement State licenses for radiological material is included in NRC’s Web-Based Licensing System, which includes information about NRC and Agreement State licenses for category 1 and 2 quantities of radiological material. In addition, the Web-Based Licensing System includes up-to-date information on all NRC and six Agreement States’ specific licenses, including licenses that authorize possession of radiological material below the category 2 threshold. However, licenses for quantities of material below the category 2 threshold issued by 31 Agreement States are not kept in the system. The CBP data systems used to identify shipments for license verification are listed in table 2. CBP has implemented a policy and procedures requiring CBP officials at airports to contact experts within a centralized CBP office to verify licenses for radiological material being shipped into the United States. Specifically, CBP issued its “Radiation Detection Standard Operating Procedures Directive” policy in March 2014, outlining when CBP officials at ports of entry are required to contact internal experts at CBP’s Teleforensic Center who possess the technical expertise to verify that NRC and Agreement State licenses for radiological materials are legitimate. The function of the Teleforensic Center is to provide field CBP officials with assistance in resolving scientific and technological questions, including detection, isolation, and control of potential threats that may result from the presence of chemical, biological, radiological, or nuclear materials. The Teleforensic Center is staffed with scientists with expertise in a range of scientific disciplines, including chemistry, biology, explosives, radiological science, and nuclear science. The Teleforensic Center has established a hotline to receive requests for license verification, among other things, and the experts are available 24 hours a day, 7 days a week. CBP’s 2014 policy requires CBP personnel to verify the legitimacy of NRC and Agreement State licenses for all commercial imports of industrial and medical radionuclides that require a license from NRC or one of the 37 Agreement States. To implement this policy, CBP has established procedures for private-sector entities and CBP. These procedures, which apply equally to all quantities and types of licensable radiological material, can be broken down into three parts: submission of paperwork, identification of material, and verification of the license by experts in the Teleforensic Center, as outlined in figure 1. Once the shipment information is entered into the Automated Commercial Environment, CBP data systems identify which shipments of radiological material require license verification. Specifically, CBP’s Automated Targeting System uses certain information to identify shipments requiring license verification. Details about this information are omitted from this report because they were deemed to be sensitive by CBP. Once shipments are flagged as containing licensable radiological material, an alert is sent to CBP officials at the airport informing them that the material requires a license from NRC or an Agreement State. The alert outlines the steps the officials need to take to verify that the license is legitimate. Among other things, the alert explicitly states the phone number for contacting the Teleforensic Center and includes instructions for handling the material. According to CBP procedures, CBP officials are not allowed to release the shipment until they receive approval from the Teleforensic Center. Officials at the Teleforensic Center primarily use NRC’s Web-Based Licensing database to verify the legitimacy of licenses granted by NRC. However, as we’ve previously reported, licenses for some radiological material that are granted by Agreement States are not kept in that database, requiring the center’s experts to also call specific points of contacts at Agreement States to verify these licenses. CBP officials told us that Agreement State offices typically are not open 24 hours a day, 7 days a week, occasionally requiring CBP to hold shipments until an official can be reached. In addition to consulting the Web-Based Licensing database and contacting Agreement State officials to verify licenses, experts at the Teleforensic Center can also request additional information from CBP officials at the airports. After the experts verify that a license is legitimate, they give approval to the CBP officials at the airport to release the shipment. CBP officials at the airport then document the release. CBP officials at the four airports we visited and experts at the Teleforensic Center told us that it typically takes 30 to 90 minutes to verify a license, but it can take longer if the experts have to consult with an Agreement State. If a license cannot be verified, the shipment is returned to the sender or, in the case of an illegal shipment, seized and referred to proper law enforcement officials, as outlined in the policy. CBP has not verified all licenses for radiological materials as required in its policy and procedures. During the 21-month period we reviewed, CBP personnel at airports across the country did not verify the legitimacy of a significant number of shipments CBP considered as containing potentially dangerous radiological material. CBP officials at two of the four airports we visited may not have verified the legitimacy of licenses for many of the shipments of radiological material imported during the 21-month period, which was not consistent with CBP policy. After we brought this issue to CBP’s attention, it issued additional guidance. However, this guidance was not clear and caused confusion at the two airports we visited where actions continued to be taken that were not consistent with CBP policy. CBP officials did not verify the legitimacy of licenses for many of the shipments of radiological material imported from January 1, 2015, to September 30, 2016. We found that during this time frame, CBP officials stationed at airports nationwide did not make the required calls to verify licenses for a significant number of shipments of radiological material identified by CBP as requiring license verification—leaving many licenses unverified over this 21-month period. These shipments came through airports across the United States and, according to CBP officials we interviewed, arrived by both express courier and air cargo companies. At two of the four airports we visited, we observed that CBP officials were taking actions that were consistent with CBP policy. Specifically, we noted the following: At one airport, officials responsible for reviewing shipments of imported radiological material told us that they call the Teleforensic Center whenever they receive an alert from CBP’s data system, consistent with CBP policy. In addition, the officials said that they send any requested information to the Teleforensic Center and wait for approval from the center before releasing shipments. At another airport, officials responsible for reviewing shipments of imported radiological material told us that they also call the Teleforensic Center whenever they receive an alert and only release shipments upon receiving approval. However, at the remaining two airports we visited, officials responsible for reviewing shipments of imported radiological material took actions that were not consistent with CBP policy to verify the legitimacy of radiological shipments entering the country. As a result, officials at these airports had not verified hundreds of licenses as required under CBP’s policy because the officials misunderstood what they were required to do. In discussions with these officials, some described taking actions that were not consistent with the license verification requirements. Details about the extent of verification are omitted from this report because the information was deemed to be sensitive by CBP. At one airport, CBP officials told us they typically verify licenses on- site without calling the Teleforensic Center. This airport had more than 100 shipments of licensable radiological material during the 21-month period for which CBP provided data, but officials only made a few calls to the Teleforensic Center to verify licenses during this time, leaving many shipments of material unverified. Instead of calling the Teleforensic Center as required, the CBP officials said that they reviewed the shipment paperwork and looked for anomalies. CBP officials said that they undertake this paperwork review regardless of the risk of the radiological material in the shipment. For example, they said they would use this approach to verify licenses for category 1 materials, which NRC and the International Atomic Energy Agency classify as likely to cause permanent injury to a person who comes into contact with them. The officials told us that they call the Teleforensic Center only when there is something wrong with the shipment. Officials at CBP headquarters told us that this procedure does not comply with their verification policy and would not be effective. At the second airport, CBP officials we interviewed told us that license verification was conducted by private-sector express couriers overseas, negating the need for officials at the port of entry to call the Teleforensic Center. The CBP officials at the airport believed that a Memorandum of Understanding (MOU) between CBP and private companies delegates responsibility to express couriers to scan material with radiation detection equipment. These CBP airport officials said that express couriers also verify licenses as part of this process. However, the MOU between CBP and express couriers does not address the verification of licenses for radiological shipments. CBP headquarters officials we interviewed told us that the airport’s practice does not comply with the agency’s verification policy and confirmed that the Teleforensic Center is the only entity that can verify licenses. The headquarters officials also reiterated to us that license verification is not conducted by overseas private-sector companies. Officials we interviewed from an express courier that ships radiological material also told us that they do not verify licenses. This airport made few calls to the Teleforensic Center to verify licenses during the 21-month period, according to the data provided to us by CBP. In February 2017, we briefed CBP headquarters officials on our findings from the site visits to the four airports. We included in our briefing a summary of findings from our site visits and information on the number of calls made by CBP officials to verify licenses. At this meeting, CBP headquarters officials indicated that they would look into why calls were not made. Subsequently, in March 2017, in response to this briefing, CBP headquarters issued additional guidance to remind all field officials of CBP’s license verification policy. The guidance states that CBP officials must contact the Teleforensic Center to verify the license for all shipments of licensable radiological material. In addition, the guidance states that shipments may not be released from the airport until experts at the Teleforensic Center have completed verification of the license. The guidance was issued in the form of a “muster”—a type of memorandum addressed to all CBP field offices to emphasize CBP policy. Once such a memorandum is issued, CBP relies on local officials to interpret and pass along this information to those working directly with the shipments. According to CBP officials, the guidance was communicated to managers and then the managers communicated this information to front-line staff through weekly meetings and informal discussions. However, the muster was not successful in correcting previous misconceptions at the two airports we visited where officials’ actions were not consistent with CBP policy and the muster did not fully resolve their noncompliance with CBP policy. In part this was because, according to officials, they found the muster confusing. In April and May 2017, several weeks after CBP issued the muster, we contacted officials at the four airports we previously visited. Based on interviews with CBP officials at the two airports where actions were not consistent with CBP policy before the muster, we determined that they were continuing to take actions that were not consistent with CBP policy after they received the muster. For example, CBP officials at one of the two airports said they were continuing to conduct license verification without the assistance of the Teleforensic Center. Officials at this airport told us that they believed their actions were consistent with the policy, even though they had not altered their actions in response to the muster. Similarly, at the other airport where actions were not consistent with the CBP policy before the muster, officials told us again that license verification can be conducted overseas by express couriers, citing the MOU allowing express couriers to scan material with radiation detection equipment. When we discussed the content of the muster with CBP officials in headquarters in June 2017, they acknowledged the muster was confusing and stated it needed to be further clarified. Subsequent to our June 2017 meeting with CBP officials, they provided additional data that suggested an increase in calls to the Teleforensic Center. In July 2017, CBP officials told us they planned to issue additional clarifications. Subsequently, in November 2017, CBP issued an additional muster emphasizing its policy to call the Teleforensic Center for all shipments of licensable radiological material. CBP headquarters officials told us that they were unaware, until we informed them, that selected airports were not calling the Teleforensic Center to verify licenses and that licenses were not being verified for some imported radiological material. This is because CBP does not have a mechanism, such as a monitoring system, to ensure that all required license verifications are occurring. Such a system could also conduct checks to ensure CBP officials are following agency policy. The challenge to creating such a system is that CBP houses the data necessary to create it in separate systems that do not communicate with each other, and these systems are currently run by different offices with differing missions within CBP. Federal standards for internal control state that management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Until CBP develops a monitoring system to help ensure that CBP officials comply with the license verification policy, the agency will not have reasonable assurance that it can identify activities that are inconsistent with its policy and take corrective action as necessary. CBP policies and procedures are not effective at ensuring that only properly licensed radiological material is imported into the United States. Specifically, CBP’s procedures for identifying licensable radiological material do not ensure that all shipments of radiological material are identified and verified, resulting in the exclusion of a significant number of shipments that possibly contained radioactive material during the 21- month period we reviewed. Moreover, CBP’s current policy and procedures treat all radiological shipments with the same level of scrutiny and do not target resources based on the risk of the material. Details about these issues are omitted from this report because the information was deemed to be sensitive by CBP. CBP procedures for identifying licensable radiological material do not effectively implement its policy to verify the license for all shipments of licensable radiological material. We identified the following issues that result in limitations in CBP’s procedures. Specifically, the data system that CBP uses to implement its procedures does not sufficiently identify all shipments of potentially dangerous radiological materials. To implement its procedures, the agency chose to use an existing data system designed to process all types of imports into the United States. This system uses general customs information to identify the contents of shipments. Consequently, of the 44,152 shipments that could contain licensable radiological material, the system alerted CBP officials that they were required to verify relatively few licenses from January 1, 2015, to September 30, 2016. In addition, CBP’s license verification procedures do not currently target the higher-risk radiological materials. CBP’s method for identifying the contents of shipments does not include information that describes the quantity of radiological material. Specifically, categories 1, 2, and 3 quantities of radiological material can cause permanent injury or death to a person in contact with them for some period of time. As a result, according to a senior CBP official, it is safer to assume all shipments of radiological material are dangerous until proven otherwise. Federal standards for internal control recommend that agencies design control activities to achieve objectives and respond to risks. Until CBP develops a robust system that can identify all shipments of radiological material that pose risk, it will not have reasonable assurance that it has the appropriate policies and procedures necessary to verify licenses for these shipments. Furthermore, as we reported in December 2016, an essential element of enterprise risk management is to examine risks considering both the likelihood of the risk and the impact of the risk on the mission, in order to help prioritize risk response. Although CBP officials recognize that their current system and procedures have limitations and do not allow them to fully implement the agency policy to verify all shipments of radiological material that enter the United States, we found that they have not developed a system nor revised their procedures to address the issues we identified. Of particular concern is that CBP has not conducted a comprehensive assessment of (1) the information not currently included in the automated alert to determine what additional information would indicate shipments that may contain dangerous material or (2) how to create a more risk-based approach that distinguishes between higher- and lower-risk categories of radiological materials. Until it conducts such an assessment, CBP will not know how to adjust its current procedures to ensure that it is identifying all shipments of potentially dangerous radiological material and targeting its limited resources to those that pose the greatest risk. CBP has implemented a policy and procedures intended to ensure that the tens of thousands of shipments of potentially dangerous radiological material imported through U.S. airports each year are properly licensed. However, CBP’s procedures do not effectively implement CBP’s policy of ensuring that only properly licensed radiological material gains entry to the United States. This is because CBP does not have a monitoring system to help ensure that CBP officials at airports nationwide are complying with the license verification policy. Until CBP develops such a system, the agency will not have reasonable assurance that it can identify activities that are inconsistent with its policy and take corrective action as necessary. In addition, CBP’s procedures for identifying licensable radiological material do not ensure that all shipments of radiological material are identified and verified. This is the result of CBP’s automated alert, which currently does not include all relevant information needed to identify such shipments. Additionally, CBP procedures do not distinguish between high-risk categories of radiological materials and lower-risk categories; therefore CBP cannot target its limited resources to the shipments that pose the greatest risk. CBP has not conducted a comprehensive assessment of the information not currently included in the automated alert and does not know which shipments pose the greatest risk. A comprehensive assessment could help CBP gain a better understanding of information not currently included in the automated alert, and it could better position the agency to make appropriate changes to its existing system and procedures, as well as target its limited resources toward the quantities of material that pose the greatest risk. We are making the following three recommendations to CBP: The Commissioner of CBP should develop a monitoring system to help ensure that CBP officials comply with license verification policies and procedures. (Recommendation 1) The Commissioner of CBP should conduct a comprehensive assessment of information not included in the automated alert to determine what information is needed to identify licensable radiological material. (Recommendation 2) The Commissioner of CBP should develop a system that better identifies shipments of radiological material that pose the greatest risk and revise CBP’s policies and procedures as necessary to verify licenses for these shipments. (Recommendation 3) We provided a draft of this product to the Department of Homeland Security (DHS) and NRC for review and comment. DHS provided written comments, reproduced in appendix I, in which it concurred with our three recommendations. DHS stated that it will take the following actions, among others, to address our recommendations: (1) include a monitoring process in an updated version of its policy addressing license verification, (2) conduct a comprehensive assessment of information not included in the automated alert to determine what information is associated with dangerous material, and (3) develop an intelligence-driven process that identifies shipments of radiological materials that pose the greatest threat. In addition, DHS and NRC provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Homeland Security, the Chairman of the U.S. Nuclear Regulatory Commission, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-3841 or trimbled@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in appendix II. In addition to the individual named above, Ned Woodward, Assistant Director; Jeffrey Barron; Richard Burkard; Kendall Childers; Cindy Gilbert; Cynthia Norris; Danny Royer; Jerry Sandau; Travis Schwartz; and Kiki Theodoropoulos made key contributions to this report.

Summary: Thousands of shipments containing radiological material enter the United States each year through airports across the country. Radiological material is used in various medical and industrial applications, and possession requires a license from the Nuclear Regulatory Commission (NRC) or one of the 37 states to which NRC has relinquished licensing authority. Failure to verify the licenses could allow terrorists to acquire radiological material for a dirty bomb, which uses explosives to disperse the material. GAO was asked to review CBP policies and procedures related to license verification. This report examines, among other things, (1) the extent to which CBP follows its policies and procedures, and (2) the effectiveness of these policies and procedures. GAO reviewed relevant policies and procedures, analyzed CBP data related to radiological material shipments and license verification, interviewed CBP and NRC officials, and selected four airports to visit based on expected traffic of radiological shipments. U.S. Customs and Border Protection (CBP) agency officials at U.S. airports have not verified the legitimacy of all licenses for imported radiological materials as required by CBP's policy. The policy requires CBP officials, when alerted, to verify licenses by calling experts in a centralized CBP office. CBP officials at two of four airports GAO visited said they were calling as required. However, CBP officials at the other two airports did not verify many licenses from January 1, 2015, through September 30, 2016, and headquarters officials were unaware of non-compliance with CBP policy. Also, GAO found that during this time frame nationwide, CBP officials were alerted to verify licenses for a significant number of shipments of licensable radiological material for all U.S. airports, but they did not make all the required calls—leaving numerous shipments potentially unverified over this 21-month period. This situation occurred because CBP does not have a monitoring system to ensure that officials make license verification calls as required. Until CBP develops a monitoring system for license verification, it will not have reasonable assurance that it can identify activities inconsistent with its policy and take corrective action. CBP procedures cannot effectively implement the agency's policy that its officials verify all radiological material shipments imported into the United States. The procedures are not effective for this policy in part because they rely on automated alerts that are based on some but not all relevant information that could indicate potentially dangerous radiological material. Consequently, CBP's current system and procedures cannot ensure that all such materials will be identified. Under federal internal control standards, agencies are to design control activities to achieve objectives and respond to risks. However, CBP does not have the information it needs to develop a robust system or revise its procedures because it has not conducted a comprehensive assessment of the information not included in its automated alert system. In particular, CBP has not assessed relevant information not currently included in the automated alert or how to create a more risk-based approach that distinguishes between higher- and lower-risk quantities of radiological materials. Without such an assessment, CBP may be unable to develop a system or procedures that best support its policy for verifying imported radiological materials. This is a public version of a sensitive report GAO issued in September 2017. Information CBP deemed sensitive has been omitted. GAO recommends that CBP develop a monitoring system to help ensure that CBP officials comply with the agency's license verification policy, conduct an assessment to determine relevant information that is not included in the automated alerts, and develop a system that allows it to identify shipments of greatest risk. CBP concurred with GAO's three recommendations and outlined actions to implement those recommendations.