Since 2003, NRC has worked with agreement states and others to identify the radioactive materials that pose the greatest risk of being used to make an RDD, established additional security measures for these materials, and taken steps to ensure the increased security measures are effectively implemented. However, NRC has not successfully corrected the weaknesses in its radioactive materials licensing processes. Further, NRC has taken limited steps to determine how to effectively mitigate the potential psychological effects of an RDD. Finally, NRC has not yet decided whether certain radioactive sources need stronger licensing requirements. An NRC and DOE working group had established a tentative list of radioactive materials under NRC license and DOE control and the quantities at which they pose the greatest risk. However, according to agreement states representatives, the agreement states were not directly involved in creating this list prior to the release of our August 2003 report. Our report recommended that the Chairman of NRC collaborate with the agreement states on this list, which NRC did before the list was finalized in August 2005. Specifically, in July 2002, the chairman of the NRC and the Secretary of Energy established a working group to identify radioactive materials according to the relative risk they posed of being used by terrorists to make an RDD. The working group assessed the relative hazards of various radioactive isotopes, taking into consideration both the nature of the materials (their potential threat to human health) and their attractiveness for use in an RDD (their half-lives, the quantities in which such materials are typically found, the level of protection typically surrounding them, and the ease with which they might be dispersed). The working group completed its initial study in November 2002 and issued a final report in May 2003. During this period, NRC, DOE, and other U.S. government entities were also negotiating with other countries under the auspices of the International Atomic Energy Agency (IAEA) to create a single international threshold quantity at which nations adopting IAEA’s Code of Conduct would agree to take measures to more closely track and consider increased security measures to protect radionuclides of concern. NRC also consulted with agreement states on this issue. In the end, it was agreed in September 2003 that the threshold for increased concern—that is, the quantities at which various radionuclides become subject to more stringent security—should be category 2 quantities. After our August 2003 recommendation that NRC consult with the agreement states on this list, NRC officials formally provided it to agreement state officials for their review. The agreement states agreed with the list and the thresholds developed by the IAEA and participating countries (see table 1). NRC also implemented our recommendations to (1) determine how agreement state and nonagreement state officials could participate in the development and implementation of additional security measures for radionuclides of concern and (2) include performance criteria for assessing NRC’s and agreement states’ implementation of these additional security requirements in periodic evaluations of both NRC and agreement state effectiveness. First, NRC worked with agreement states to devise and implement several additional security measures—called “increased controls” —to protect category 2 or greater quantities of radionuclides of concern from theft, diversion, and other unauthorized access. In late 2003, NRC and state officials, some of whom were also officers of the Organization of Agreement States or Conference of Radiation Control Program Directors (an organization that includes both agreement and nonagreement states), established several working groups to facilitate the participation of state officials and their organizations in developing and implementing additional security measures for certain radioactive sources and materials. Several state officials, including a former chair of the Organization of Agreement States (OAS), told us that these working groups functioned in a highly collaborative and deliberative manner. Another OAS official told us that the fact that so many agreement state officials have been willing to volunteer to serve in working groups, and that NRC has been willing to provide some financial support for state officials’ involvement, is a testament to the importance that both NRC and agreement states placed on federal-state collaboration. NRC and agreement states officially issued requirements for the increased controls in December 2005. The purposes of the increased controls, according to NRC, are to reduce the risk of unauthorized use of radioactive materials and to aid the prompt detection and assessment of and response to any such attempt. Increased controls include such measures as 24-hour surveillance, multiple layers of physical security, and measures to ensure the immediate notification of local law enforcement agencies in the event of any actual or suspected breach in security. For example, increased controls on medical sources require some sources to be kept in heavily secured rooms with limited access (see fig. 1). According to NRC, all increased controls were to be fully implemented by June 2006. Some licensees with the highest-risk sources were inspected by June 2007, while all increased controls must be fully inspected by June 2009. NRC regional offices and agreement state regulators are also currently in the process of reaching out to licensees to help ensure they will be able to meet the June 2009 deadline and have already performed preliminary increased controls inspections on approximately 1,100 of the 1,700 licensees subject to the new controls (see table 2). Agreement state officials told us that they have already prevented at least one attempted theft of an industrial radiography source typically used to inspect metal parts and welds for defects. The would-be thieves broke in to an area protected by an alarm system that had been recently installed by the licensee to comply with the new requirement mandating the capacity to monitor, detect, and respond quickly with local law enforcement in the event of any unauthorized access. This new alarm system immediately notified local law enforcement authorities, who responded in time to prevent the criminals from obtaining an iridium-192 radiography source—a potent gamma emitter that could cause extensive radiation burns if handled improperly. NRC and agreement states have also collaborated in establishing criteria for assessing the implementation of increased controls and integrated these criteria into NRC’s existing oversight program, the Integrated Materials Performance Evaluation Program (IMPEP). In March 2006, NRC established performance criteria devised in working groups with agreement state officials for evaluating the implementation of increased controls. Under each of the existing performance categories—staffing and training, the technical quality of inspections, licensing actions, incident and allegation activities, and the overall status of the materials inspection program—NRC added additional performance criteria. For example, NRC regional and agreement state programs are now evaluated on whether they have established a system to readily identify new licensees that should be subject to increased controls and to determine whether sensitive licensee information is being securely maintained. Although not all NRC regional and agreement states’ radioactive materials programs have been evaluated on their implementation of the increased controls, 22 of the 35 agreement states and one of the three NRC regional offices with responsibilities for regulating such materials have to date had aspects of their implementation of increased controls at least partially assessed in this manner. Moreover, agreement state officials familiar with this revised performance evaluation process told us that the new criteria were effective and valid measures of the implementation of the increased controls. To increase the security of radioactive materials and sealed sources and better ensure that they are used as intended, we recommended in 2003 that NRC modify its process for issuing specific licenses to ensure that such sources cannot be purchased before NRC has verified, through inspection or other means, that the materials and sources will be used as intended. In December 2006, NRC issued new prelicensing guidance to help NRC and agreement state licensing officials to make a risk-based determination of whether an applicant for a license to possess an amount of radioactive material or source sufficient to require a specific (rather than a general) license should have to undergo some sort of verification before being granted a license. This guidance asked two screening questions: (1) whether “the applicant is an entity or a licensee transferring control to an entity that has never had a license or is unknown” and (2) whether the applicant is seeking category 2 or greater quantities of one or more of the 16 radionuclides of concern and has not already been licensed to possess materials subject to a security order or additional requirements for increased controls. If the applicant answers yes to either question, according to the guidance, the license examiner should consider whether it is necessary to take any of the steps on a 12-item checklist. For example, one checklist item suggests doing an Internet search on the name of the applicant; another suggests conducting a site visit to the stated place of business. In spring 2007, however, our investigators, posed as first-time radioactive materials license applicants for devices containing sources large enough to require specific licenses, and therefore subject to the extra scrutiny from the 12-item checklist, they were able to obtain a materials license from NRC, even though an Internet search or a prelicensing site visit would have revealed the application to be based on false claims. After being notified of the results of our undercover investigation in June, NRC stopped issuing specific licenses for radioactive materials and sources until it could develop and issue “supplemental interim prelicensing guidance.” This supplemental guidance, issued 12 days after NRC stopped issuing specific licenses, requires a first-time licensee to pass a site visit inspection at the applicant’s place of business or appear at an NRC regional office for a face-to-face meeting with a license application reviewer and satisfy this official that the radioactive materials will be used as intended. Applicants would not be subject to these requirements if they already have an established regulatory relationship with NRC or an agreement state and meet other specific criteria. In September 2007, NRC announced in a public briefing that it had developed a comprehensive plan for resolving all the vulnerabilities in its radioactive materials licensing processes. NRC announced plans to do several things to help make its program more secure, including the following. Establish a panel of independent external reviewers to study NRC’s materials licensing program vulnerabilities, with particular scrutiny of its “good faith assumptions” about applicants.