Our recent analyses of NRC programs identified several areas where NRC needs to take action to better fulfill its mission and made associated recommendations for improvement. With respect to NRC’s security mission, we found that the security of sealed radioactive sources and the physical security at nuclear power plants need to be strengthened. With respect to its public health and safety, and environmental missions, we found several shortcomings that need to be addressed. NRC’s analyses of plant owners’ contributions could be improved to better ensure that adequate funds are accumulating for the decommissioning of nuclear power plants. By contrast, we found that NRC is ensuring that requirements for liability insurance for nuclear power plants owned by limited liability companies are being met. Further, to ensure the safety of nuclear power plants NRC must more aggressively and comprehensively resolve oversight issues related to the shutdown of the Davis-Besse plant. Finally, NRC’s methods of ensuring that power plants are effectively controlling spent nuclear fuel need to be improved. In August 2003, we reported on federal and state actions needed to improve security of sealed radioactive sources. Sealed radioactive sources, radioactive material encapsulated in stainless steel or other metal, are used worldwide in medicine, industry, and research. These sealed sources could be a threat to national security because terrorists could use them to make “dirty bombs.” We were asked among other things to determine the number of sealed sources in the United States. We found that the number of sealed sources in use today in the United States is unknown primarily because no state or federal agency tracks individual sealed sources. Instead, NRC and the agreement states track numbers of specific licensees. NRC and the Department of Energy (DOE) have begun to examine options for developing a national tracking system, but to date, this effort has had limited involvement by the agreement states. NRC had difficulty locating owners of certain generally licensed devices it began tracking in April 2001, and has hired a private investigation firm to help locate them. Twenty-five of the 31 agreement states that responded to our survey indicated that they track some or all general licensees or generally licensed devices, and 17 were able to provide data on the number of generally licensed devices in their jurisdictions, totaling approximately 17,000 devices. GAO recommended that NRC (1) collaborate with states to determine the availability of the highest risk sealed sources, (2) determine if owners of certain devices should apply for licenses, (3) modify NRC’s licensing process so sealed sources cannot be purchased until NRC verifies their intended use, (4) ensure that NRC’s evaluation of federal and state programs assesses the security of sealed sources, and (5) determine how states can participate in implementing additional security measures. NRC disagreed with some of our findings. In September 2003, we reported that NRC’s oversight of security at commercial nuclear power plants needed to be strengthened. The September 11, 2001, terrorist attacks intensified the nation’s focus on national preparedness and homeland security. Among possible terrorist targets are the nation’s nuclear power plants which contain radioactive fuel and waste. NRC oversees plant security through an inspection program designed to verify the plants’ compliance with security requirements. As part of that program, NRC conducted annual security inspections of plants and force-on-force exercises to test plant security against a simulated terrorist attack. GAO was asked to review (1) the effectiveness of NRC’s security inspection program and (2) legal challenges affecting power plant security. At the time of our review, NRC was reevaluating its inspection program. We did not assess the adequacy of security at the individual plants; rather, our focus was on NRC’s oversight and regulation of plant security. We found that NRC had taken numerous actions to respond to the heightened risk of terrorist attack, including interacting with the Department of Homeland Security and issuing orders designed to increase security and improve defensive barriers at plants. However, three aspects of NRC’s security inspection program reduced the agency’s effectiveness in overseeing security at commercial nuclear power plants. First, NRC inspectors often used a process that minimized the significance of security problems found in annual inspections by classifying them as “non-cited violations” if the problem had not been identified frequently in the past or if the problem had no direct, immediate, adverse consequences at the time it was identified. Non-cited violations do not require a written response from the licensee and do not require NRC inspectors to verify that the problem has been corrected. For example, guards at one plant failed to physically search several individuals for metal objects after a walk-through detector and a hand-held scanner detected metal objects in their clothing. These individuals were then allowed unescorted access throughout the plant’s protected area. By extensively using non-cited violations for serious problems, NRC may overstate the level of security at a power plant and reduce the likelihood that needed improvements are made. Second, NRC did not have a routine, centralized process for collecting, analyzing, and disseminating security inspections data to identify problems that may be common to plants or to provide lessons learned in resolving security problems. Such a mechanism may help plants improve their security. Third, although NRC’s force-on-force exercises can demonstrate how well a nuclear plant might defend against a real-life threat, several weaknesses in how NRC conducted these exercises limited their usefulness. Weaknesses included (1) using more personnel to defend the plant during these exercises than during normal operations, (2) using attacking forces that are not trained in terrorist tactics, and (3) using unrealistic weapons (rubber guns) that do not simulate actual gunfire. Furthermore, at the time, NRC has made only limited use of some available improvements that would make force-on-force exercises more realistic and provide a more useful learning experience. Finally, we also found that even if NRC strengthens its inspection program, commercial nuclear power plants face legal challenges in ensuring plant security. First, federal law generally prohibits guards at these plants from using automatic weapons, although terrorists are likely to have them. As a result, guards at commercial nuclear power plants could be at a disadvantage in firepower, if attacked. Second, state laws regarding the permissible use of deadly force and the authority to arrest and detain intruders vary, and guards were unsure about the extent of their authorities and may hesitate or fail to act if the plant is attacked. GAO made recommendations to promptly restore annual security inspections and revise force-on-force exercises. NRC disagreed with many of GAO’s findings, but did not comment on GAO’s recommendations. In September 2004, we testified on our preliminary observations regarding NRC’s efforts to improve security at nuclear power plants. The events of September 11, 2001, and the subsequent discovery of commercial nuclear power plants on a list of possible terrorist targets have focused considerable attention on plants’ capabilities to defend against a terrorist attack. NRC is responsible for regulating and overseeing security at commercial nuclear power plants. We were asked to review (1) NRC’s efforts since September 11, 2001, to improve security at nuclear power plants, including actions NRC had taken to implement some of GAO’s September 2003 recommendations to improve security oversight, and (2) the extent to which NRC is in a position to assure itself and the public that the plants are protected against terrorist attacks. The testimony reflected the preliminary results of GAO’s review. We are currently performing a more comprehensive review in which we are examining (1) NRC’s development of its 2003 design basis threat (DBT), which establishes the maximum terrorist threat that commercial nuclear power plants must defend against, and (2) the security enhancements that plants have put in place in response to the design basis threat and related NRC requirements. We expect to issue a report on our findings later this year. In the earlier work, we found that NRC responded quickly and decisively to the September 11, 2001, terrorist attacks with multiple steps to enhance security at commercial nuclear power plants. NRC immediately advised plants to go to the highest level of security using the system in place at the time, and issued advisories and orders for plants to make certain enhancements, such as installing more physical barriers and augmenting security forces, which could be quickly completed to shore up security. According to NRC officials, their inspections found that plants complied with these advisories and orders. Later, in April 2003, NRC issued a new DBT and required the plants to develop and implement new security plans to address the new threat by October 2004. NRC is also improving its force-on-force exercises, as GAO recommended in its September 2003 report. While its efforts had enhanced security, NRC was not yet in a position to provide an independent determination that each plant has taken reasonable and appropriate steps to protect against the new DBT. According to NRC officials, the facilities’ new security plans were on schedule to be implemented by October 2004. However, NRC’s review of the plans, which are not available to the general public for security reasons, had primarily been a paper review and was not detailed enough for NRC to determine if the plans would protect the facility against the threat presented in the DBT. In addition, NRC officials generally were not visiting the facilities to obtain site-specific information and assess the plans in terms of each facility’s design. NRC is largely relying on the force- on-force exercises it conducts to test the plans, but these exercises will not be conducted at all facilities for 3 years. We also found that NRC did not plan to make some improvements in its inspection program that GAO previously recommended. For example, NRC was not following up to verify that all violations of security requirements had been corrected, nor was the agency taking steps to make “lessons learned” from inspections available to other NRC regional offices and nuclear power plants.