Since the September 11, 2001, terrorist attacks there has been concern that certain radioactive material could be used in the construction of a radiological dispersion device (RDD). An RDD disperses radioactive material over a particular target area, which could be accomplished using explosives or by other means. The major purpose of an RDD would be to create terror and disruption, not death or destruction. Depending on the type, form, amount, and concentration of radioactive material used, direct radiation exposure from an RDD could cause health effects to individuals in proximity to the material for an extended time; for those exposed for shorter periods and at lower levels, it could potentially increase the long- term risks of cancer. In addition, the evacuation and cleanup of contaminated areas after dispersal could lead to panic and serious economic costs on the affected population. In 2003, a joint NRC/Department of Energy (DOE) interagency working group identified several radioactive materials (including Americium-241 and Cesium-137) as materials at higher risk of being used in an RDD, describing these as “materials of greatest concern.” In its risk-based approach to securing radioactive sources, NRC has made a commitment to work toward implementing the provisions of IAEA’s Code of Conduct. This document provides a framework that categorizes the relative risk associated with radioactive sources. While NRC has recently focused on upgrading its capacity to track, monitor, and secure category 1 and 2 sources, which are considered high risk, category 3 sources are not a primary focus of NRC regulatory efforts. Category 3 sources include byproduct material, which is radioactive material generated by a nuclear reactor, and can be found in equipment that has medical, academic, and industrial applications. For example, a standard type of moisture gauge used by many construction companies contains small amounts of Americium-241 and Cesium-137. According to NRC, it would take 16 curies of Americium-241 to constitute a high-risk category 2 quantity, and 1.6 curies of Americium-241 is considered a category 3 quantity. In October and November 2006, using fictitious names, our investigators created two bogus companies—one in an agreement state and one in a non-agreement state. After the bogus businesses were incorporated, our investigators prepared and submitted applications for a byproduct materials license to both NRC and the department of the environment for the selected agreement state. The applications, mailed in February 2007, were identical except for minor differences resulting from variations in the application forms. Using fictitious identities, one investigator represented himself as the company president in the applications, and another investigator represented himself as the radiation safety officer. The license applications stated that our company intended to purchase machines with sealed radioactive sources. According to NRC guidance finalized in November 2006 and sent to agreement states in December 2006, both NRC and agreement state license examiners should consider 12 screening criteria to verify that radioactive materials will be used as intended by a new applicant. For example, one criterion suggests that the license examiner perform an Internet search using common search engines to confirm that an applicant company appears to be a legitimate business that would require a specific license. Another screening technique calls for the license examiner to contact a state agency to confirm that the applicant has been registered as a legitimate business entity in that state. If the examiner believes there is no reason to be suspicious, he or she is not required to take the steps suggested in the screening criteria and may indicate “no” or “not applicable” for each criteria. If the license examiner takes additional steps to evaluate a criterion, he or she should indicate what publicly available information was considered. If there is concern for a potential security risk, the guidance instructs license examiners to note the basis for that concern. Nine days after mailing their application form to NRC, our investigators received a call from an NRC license examiner. The NRC license examiner stated that the application was deficient in some areas and explained the necessary corrections. For example, the license examiner asked our investigators to certify that the machines containing sealed radioactive source material, which are typically used at construction sites, would be returned to the company office before being transported to a new construction site. The license examiner explained that this was a standard security precaution. Even though we did not have a company office or a construction site, our investigators nevertheless certified their intent to bring the machines back to their office before sending them to a new location. They made this certification via a letter faxed to NRC. Four days after our final correction to the license application, NRC approved our application and mailed the license to the bogus business in the non- agreement state. It took a total of 4 weeks to obtain the license. See figure 1 for the first page of the transmittal letter we received from NRC with our license. The NRC license is printed on standard 8-1/2 x 11 inch paper and contains a color NRC seal for a watermark. It does not appear to have any features that would prevent physical counterfeiting. We therefore concluded that we could alter the license without raising the suspicion of a supplier. We altered the license so that it appeared our bogus company could purchase an unrestricted quantity of sealed source materials rather than the small amounts of Americium-241 and Cesium-137 listed on the original license. We determined the proper language for the license by reviewing publicly available information. Next, we contacted two U.S. suppliers of the machines specified in our license. We requested price quotes and faxed the altered license to the suppliers as proof that we were certified to purchase the machines. Both suppliers offered to sell us the machines and provided us price quotes. One of these suppliers offered to provide twice as many machines as we requested and offered a discount for volume purchases. In a later telephone call to one of the suppliers, a representative of the supplier told us that his company does not check with NRC to confirm the terms listed on the licenses that potential customers fax them. He said that his company checks to see whether a copy of the front page of the license is faxed with the intent to purchase and whether the requested order exceeds the maximum allowable quantity a licensee is allowed to possess at any one time. Although we had no legitimate use for the machines, our investigators received, within days of obtaining a license from NRC, price quotes and terms of payment that would have allowed us to purchase numerous machines containing sealed radioactive source materials. These purchases would have substantially exceeded the limit that NRC approved for our bogus company. If these radioactive materials were unsealed and aggregated together, the machines would yield an amount of Americium-241 that exceeds the threshold for category 3 materials. As discussed previously, according to IAEA, category 3 sources are dangerous if not safely managed or securely protected and “could cause permanent injury to a person who handled them, or was otherwise in contact with them, for some hours. It could possibly—although it is unlikely—be fatal to be close to this amount of unshielded radioactive material for a period of days to weeks.” Importantly, with patience and the proper financial resources, we could have accumulated, from other suppliers, substantially more radioactive source material than what the two suppliers initially agreed to ship to us—potentially enough to reach category 2. According to IAEA, category 2 sources, if not safely managed or securely protected, “could cause permanent injury to a person for a short time (minutes to hours), and it could possibly be fatal to be close to this amount of unshielded material for a period of hours to days.” Ten days after mailing their application form to the agreement state’s department of environment, our investigators received a call from a department license examiner. The license examiner stated that the application was deficient in some areas and said that she would send us a letter outlining what additional information the state required before approving the license. The examiner further stated that before the license was granted, she would conduct a site visit to inspect the company office and storage facilities cited in our application. Our investigators subsequently decided not to pursue the license in this state and requested that their application be withdrawn. According to an official in the department of environment for this state, the license examiner followed the required state procedure in requesting a site visit. The official told us that as a matter of long-standing state policy, license examiners in this state conduct site visits and interview company management (especially radiation safety officers) before granting new licenses for radioactive materials. This state policy is more stringent than the guidance NRC provided agreement states in December 2006. The NRC guidance identified a site visit as one possible screening criterion to use in evaluating a new license application, but, as discussed above, a site visit is not required under the NRC guidance. On June 1, 2007, we contacted NRC and discussed the results of our work. An NRC official indicated that NRC would take immediate action to address the weaknesses we identified. After this meeting, we learned that NRC suspended its licensing program for specific licenses until it could determine what corrective actions were necessary to resolve the weaknesses. NRC also held a teleconference with a majority of the 34 agreement states to discuss our work. On June 12, 2007, NRC issued supplemental interim guidance with additional screening criteria. These criteria are intended to help a license examiner determine whether a site visit or face-to-face meeting with new license applicants is required. NRC told us that it planned to convene a working group to develop improved guidance addressing the weaknesses we identified. NRC’s goal is to provide licenses to only those entities that can demonstrate that they have legitimate uses for radioactive materials. However, our work shows that there continues to be weaknesses in the process NRC uses to approve license applications. In our view, a routine visit by NRC staff to the site of our bogus business would have been enough to reveal our lack of facilities and equipment.