NRC is an independent agency established by the Energy Reorganization Act of 1974 to regulate the civilian use of nuclear materials. NRC is headed by a five-member commission, with one commission member designated by the President to serve as chairman and official spokesperson. The commission as a whole formulates policies and regulations governing nuclear reactor and materials safety and security, issues orders to licensees, and adjudicates legal matters brought before it. Security for commercial nuclear power plants is addressed by NRC’s Office of Nuclear Security and Incident Response. This office develops policy on security at nuclear facilities and is the agency’s security interface with DHS, the intelligence and law enforcement communities, DOE, and other agencies. Within this office, the Threat Assessment Section assesses security threats involving NRC-licensed activities and develops recommendations regarding the DBT for the commission’s consideration. The DBT for radiological sabotage applied to nuclear power plants identifies the terrorist capabilities (or “adversary characteristics”) that sites are required to defend against. The adversary characteristics generally describe the components of a ground assault and include the number of attackers; the size of a vehicle bomb; and the weapons, equipment, and tactics that could be used in an attack. Other threats in the DBT include a waterborne assault and the threat of an insider. The DBT does not include the threat of an airborne attack. However, according to NRC officials, NRC regulations do require nuclear power plants to implement readily available measures to mitigate against the potential consequences of such an attack. In its publicly available regulations governing the licensing of nuclear power plants, NRC has issued a general description of the DBT—for example, requiring sites to defend against an attack by several well-trained and dedicated individuals armed with hand-carried weapons and equipment and assisted by a knowledgeable insider who participates in a passive or active role. In April 2003, NRC issued orders to nuclear power plant licensees containing a more detailed description of the revised DBT, which NRC considers safeguards information. NRC requires nuclear power plants to have and implement a security plan that describes their strategy for defending against an attack having the characteristics of the DBT. Nuclear power plant sites are responsible for installing barriers and intrusion detection equipment, hiring security officers, and implementing other measures in accordance with their security plans. NRC then inspects the sites’ compliance with the plans and ability to defend against the DBT. After revising the DBT, NRC required sites to submit new plans by April 29, 2004, for NRC’s review and approval and to implement the security described in their new plans by October 29, 2004. The plans contain information about the sites, including a description of sites’ physical layout, such as barriers and buildings, and a description of any environmental features important to the effective coordination of response operations; the minimum number of security officers defending the vital areas (the areas containing equipment needed to ensure the safe shutdown of the reactor and protection of spent fuel pools); and a description of the protective strategy that sites will enact in response to an attack or threat defined in the DBT, such as an external land-based assault, a vehicle bomb, a waterborne assault, or an insider threat. NRC’s performance-based means for testing the effectiveness of nuclear power plant security programs is through force-on-force inspections. These inspections, which consist of 350 hours of on-site inspection activity, are intended to demonstrate how well a nuclear power plant might defend against a real-life threat. In a force-on-force inspection, a professional team of adversaries attempts to reach specific “target sets” within a nuclear power plant that would allow them to commit radiological sabotage. These target sets represent the minimum pieces of equipment or infrastructure an attacker would need to destroy or disable to commit radiological sabotage resulting in an elevated release of radioactive material to the environment. Force-on-force exercises do not directly test the response of outside agencies, such as local law enforcement. However, sites simulate actions they would take to notify local law enforcement and other outside agencies. In addition, according to NRC officials, sites routinely conduct liaison activity with local law enforcement and emergency response agencies. While the adversary characteristics terrorists might use in an actual attack are uncertain, the DBT provides parameters for the conduct of force-on- force inspections. For example, the mock adversary force is constrained to using the specific number of attackers, amount of explosives, and weapons and tactics included in the DBT. According to NRC officials, the commission recently approved an option to conduct force-on-force inspections using adversary characteristics that go beyond those in the DBT. This option would be available on a voluntary basis to nuclear power plant licensees that are clearly successful in defending against the first two mock attacks of the force-on-force inspection, which typically includes three mock exercises over 3 days. NRC also conducts baseline inspections at nuclear power plants to determine that licensees have established measures to deter, detect, and protect against the DBT for radiological sabotage. Security inspectors in NRC’s four regional offices conduct the inspections. NRC’s policy is to conduct a baseline inspection at each site every year, with the complete range of baseline inspection activities conducted over a 3-year cycle. One element of a baseline inspection is evaluating the site’s protective strategy—for example, by conducting tabletop drills (simulated attacks using a model of the site) to gain a better understanding of the strategy. Inspectors also examine areas such as officer training, fitness for duty, positioning and operational readiness of multiple physical and technical security components, and the controls the licensee has in place to ensure that unauthorized personnel do not gain access to the protected area. According to NRC officials, agency inspectors spend a total of 136 hours annually at a site for a baseline inspection, and the 3-year baseline inspection cycle involves more than 400 hours of inspection activity. For both force-on-force and baseline inspections, licensees are responsible for immediately correcting or compensating for any deficiency in which NRC concludes that security is not in accordance with the approved security plans or other security orders. According to its inspection manual, NRC has 45 days to send a licensee a report on the results of an inspection, including any findings and the licensee’s corrective actions. DHS has overall responsibility among federal agencies for assessing the vulnerability of the nation’s critical infrastructure to terrorist attacks and coordinating efforts to enhance security. Nuclear power plants represent one sector of the critical infrastructure. Other sectors include such things as agriculture, chemical facilities, and transportation systems. In 2005, DHS began a series of visits to nuclear power plant sites to conduct comprehensive security reviews in order to assess the risks and consequences of various types of events and to provide better information on the most effective allocation of federal resources to improve security at critical infrastructure sites. DHS conducts the comprehensive reviews with relevant agencies such as the FBI and, in the case of nuclear power plants, NRC. According to DHS, the comprehensive reviews for nuclear power plants focus primarily on the security of the sites “outside the fence”—the aspects of security outside the responsibility and control of the nuclear power plant licensees. DHS relies on NRC to regulate the security of nuclear power plants “inside the fence.” DHS officials told us that the nuclear power sector is one of the few critical infrastructure sectors in which the federal government has the authority to regulate the security of sites. According to DHS, as of December 2005, the agency had completed 14 comprehensive reviews at nuclear power plant sites. The process that NRC used to revise its DBT for nuclear power plants was generally logical and well defined. In particular, the process included an analysis of intelligence and law enforcement information on terrorist capabilities and consultation with DOE, which also has a DBT for its facilities that are potential targets for terrorists seeking to cause radiological sabotage. Using this process, NRC produced a revised DBT that usually corresponded to the original recommendations of NRC’s threat assessment staff. However, certain elements of the revised DBT, such as the weapons that attackers could use against a plant, do not correspond to the staff’s original recommendations for two reasons. First, the NRC threat assessment staff charged with reviewing intelligence information made changes to its recommendations after receiving feedback from stakeholders, including the nuclear industry. Given the high degree of judgment involved in assessing threat information, the process NRC used to obtain stakeholder feedback created the appearance that changes were made based on industry views rather than an assessment of the terrorist threat. Second, the NRC commissioners made changes to the staff’s recommendations on the basis of what is reasonable for a private security force to defend against but did not identify explicit criteria for such policy judgments. NRC made its 2003 revisions to the DBT for nuclear power plants as part of a process that the agency has used since first issuing the DBT in the late 1970s. In this process, NRC staff trained in threat assessment use reports and secure databases provided by the intelligence community to monitor information on terrorist activities worldwide. The staff analyze this information both to identify specific references to nuclear power plants and to determine the capabilities that terrorists have acquired and how they might use those capabilities to attack nuclear power plants in the United States. The staff normally summarize applicable intelligence information and any recommendations for changes to the DBT in semiannual reports to the NRC commissioners on the threat environment. In addition, the threat assessment staff promptly report changes in the threat to the commissioners and coordinate with the intelligence agencies to help ensure that the staff are aware of all pertinent intelligence information. In 1999, the NRC staff began developing a set of criteria—the adversary characteristics screening process—to decide whether to recommend particular adversary characteristics for inclusion in the DBT and to enhance the predictability and consistency of their recommendations.