Combating Nuclear Terrorism: NRC Needs to Take Additional Actions to Ensure the Security of High-Risk Radioactive Material

NRC is responsible for regulating the security of radioactive material in the U.S. Failure to secure this material could result in an RDD causing socioeconomic damage. The Consolidated and Further Continuing Appropriations Act, 2015 (Public Law 113-235) includes a provision for GAO to review NRC's security requirements for high-risk radioactive material. This report examines, among other things, (1) the extent to which radioactive security experts agreed that NRC's assessment of risk includes all relevant criteria, and (2) NRC's 2016 evaluation of its security requirements for high-risk radioactive material. GAO reviewed NRC policies and procedures, worked with the National Academies of Sciences to convene a meeting with 18 experts in radioactive security, and reviewed 3 recent Sandia studies. GAO used the views of security experts to define high risk, and they generally agreed that high risk includes both larger and some smaller quantities of radioactive materials.

The 18 experts at a meeting GAO convened with the National Academies of Sciences generally agreed that the Nuclear Regulatory Commission (NRC) assessment of risks of radioactive material does not include all relevant criteria. NRC limits its criteria to prompt fatalities and deterministic health effects from radiation, which, according to the experts and recent studies, are unlikely to result from a radiological dispersal device (RDD). Two studies from Sandia National Laboratories (Sandia) measuring consequences of RDDs, released in 2017 and 2018, found that there would be no immediate fatalities from radiation. The experts at the meeting generally agreed that socioeconomic effects (e.g., relocations and clean-up costs) and fatalities that could result from evacuations are the most relevant criteria for evaluating the risks of radioactive material. The two Sandia studies found that a large RDD could cause about $30 billion in damage and 1,500 fatalities from the evacuation, and a considerably smaller RDD could cause $24 billion in damage and 800 fatalities from the evacuation. By considering socioeconomic impacts and fatalities resulting from evacuations in its criteria, NRC would have better assurance it was considering the more likely and more significant consequences of an RDD.

NRC's 2016 report evaluating its security requirements for high-risk radioactive material, required by Public Law 113-235, considered only the security of larger quantities of such material and not smaller quantities. Experts who attended GAO's meeting stated, and two 2018 Sandia studies agree, that if smaller quantities of certain radioactive material were used in an RDD, the impacts would be comparable to an RDD with a considerably larger amount of such material. For example, a 2018 study from Sandia found that malicious use of certain radioactive materials in smaller quantities could cause significant socioeconomic consequences. By requiring additional security measures for these smaller quantities of high-risk material, NRC can have better assurance that its security requirements are sufficient to secure all high-risk radioactive material from theft and use in an RDD.

Example of a Radiological Dispersal Device (RDD)

GAO is making three recommendations to NRC, including that it consider socioeconomic consequences and fatalities from evacuations as criteria for determining security measures and require additional security measures for smaller quantities of high-risk material. NRC generally disagreed with the recommendations, stating that GAO's evidence does not provide a sufficient basis for recommended changes. GAO continues to believe these recommendations are important.

Radioactive material is used in thousands of locations throughout the  United States for medical, industrial, and research purposes, such as  treating cancer, sterilizing food and medical instruments, and detecting  flaws in metal welds. However, in the hands of terrorists, radioactive  material—such as americium-241, cesium-137, cobalt-60, and iridium- 192—could be used to construct a radiological dispersal device (RDD),  also referred to as a “dirty bomb,” that uses conventional explosives to  disperse radioactive material. Depending on the type, form, amount, and  concentration of radioactive material used, an RDD could expose nearby  individuals to radiation and increase their long-term risks of cancer. In  addition, the evacuation and cleanup of contaminated areas could lead to  serious socioeconomic costs, as individuals with homes and businesses  in those areas may not be able to return for an extended period because  of actual or feared contamination. Terrorist activity in the United States,  Europe, and the Middle East has heightened concerns about RDDs and  the need to better secure certain radioactive material. Furthermore,  according to NRC, there exists a general credible threat on the  malevolent use of radioactive materials in the United States. In addition,  the International Atomic Energy Agency (IAEA) reported 3,068  unauthorized activities and events worldwide involving nuclear and  radioactive material from 1993 to 2016, including incidents of trafficking  and malicious use.

The U.S. Nuclear Regulatory Commission (NRC) is responsible for  licensing the commercial use and regulating the security of radioactive  material in the United States. Prior to 2003, NRC did not have specific  orders intended to address security, but its safety regulations included  general provisions that licensees “secure from unauthorized removal or  access” radiological sources in storage, and “control and maintain  constant surveillance” over materials not in storage. On March 19, 2013,  NRC finalized a rule amending its regulations to establish security  requirements for the use of risk-significant radioactive material. These  amendments were codified as Part 37 of Title 10 of the Code of Federal  Regulations, and are generally referred to as “Part 37”. Part 37 brings  together a set of previously issued orders into one set of requirements  that addresses topics such as physical security, access control,  monitoring and detection, incident response and coordination with local  law enforcement authorities, and employee trustworthiness and  reliability.

In addition to NRC, the National Nuclear Security Administration (NNSA),  the Department of Homeland Security (DHS), the Environmental  Protection Agency (EPA), and the Federal Bureau of Investigation (FBI),  among others, play a role in radioactive material security. According to  NNSA’s website, NNSA’s Office of Radiological Security evaluates  existing security systems at NRC licensees and provides upgrades and  enhancements to existing security measures, removes and disposes of  disused radioactive material, and works to reduce global reliance on high- activity radioactive material by promoting the development and adoption  of non-radioisotopic alternative technologies. DHS is the primary federal  agency for implementing domestic nuclear detection efforts that support a  managed and coordinated response to radioactive and nuclear threats. In  the event of an emergency involving radioactive material, EPA’s  Radiological Emergency Response Team works with federal, state, and  local agencies to monitor radioactivity and clean up affected areas. In  addition, EPA has developed the Protective Action Guide (PAG)  manual—which contains radiation dose guidelines that could trigger  public safety measures, such as instructions to evacuate or stay  indoors—to support actions necessary to protect people from unhealthy  levels of radiation. The FBI maintains Weapons of Mass Destruction  Coordinators at its 56 field offices who are responsible for building  relationships with NRC licensees, including nuclear power plants, medical  facilities, and academic institutions. The FBI also informs other federal  agencies and licensees if it learns of a specific radioactive security threat.

We have previously reported on weaknesses in NRC and DHS policies  and procedures to prevent unauthorized individuals from obtaining  radioactive material. In July 2007, we established a fake business and  obtained a real license, which we used to secure commitments to  purchase a dangerous quantity of radioactive material. To address this  weakness in NRC licensing, we made three recommendations addressing  how NRC ensured applicants for licenses are legitimate and that bad  actors are not able to use a counterfeit license to acquire radioactive  material. NRC agreed with and implemented all three recommendations,  suspended its licensing program in 2007, and issued stricter interim pre- licensing guidance requiring site visits or face-to-face meetings prior to  issuing new licenses. In September 2012, we found security weaknesses  at U.S. medical facilities, and in a June 2014 report, we identified  security challenges at industrial facilities. In the September 2012 report,  we made four recommendations, including a joint recommendation to  NNSA and NRC to increase NNSA’s outreach efforts and three  recommendations to NRC to update its training, supplement its guidance,  and provide licensees with specific security measures to secure  radioactive material. NNSA and NRC agreed and implemented three of  the recommendations, but NRC did not agree with and implement the  recommendation to provide hospitals with specific measures to improve  security. For the June 2014 report, we made four recommendations,  including, among other things, directing NRC to reconsider the definition  used for collocation of radioactive material and conduct an assessment of  the Trustworthiness and Reliability process used to protect against an  insider threat. NRC agreed and implemented all four recommendations  made in the report.

Furthermore, in July 2016, we again tested the rigor of NRC’s licensing  process by establishing three fake businesses and successfully obtained  a real license for one of these businesses. We then used that license to  obtain commitments to purchase a quantity of radioactive material that  would be dangerous if not properly secured. In the 2016 report, we  made three recommendations directing NRC to take steps to better track  certain radioactive material, confirm the validity of transfers of material,  and consider on-site security reviews for unknown applicants to ensure  material cannot be purchased without a verified license. NRC stated that  it understood our recommendations and has not yet implemented them.  In January 2018, we found gaps in how DHS’s Customs and Border Protection (CBP) ensures only properly licensed radioactive material is  imported into the United States. In that report, we made three  recommendations, directing CBP to develop a monitoring system for how  they verify licenses for imported radioactive material, conduct an  assessment of the information not included in its automated alert for  radioactive material, and better identify shipments of material that pose  the greatest risk. CBP agreed with our recommendations and has  undertaken its assessment for verifying licenses, but has not yet  developed a monitoring system to ensure compliance nor developed a  system to identify material that poses the greatest risk.

The Consolidated and Further Continuing Appropriations Act, 2015  (Public Law 113-235) included a provision for NRC to evaluate the  effectiveness of its current security requirements to protect high-risk  radioactive material. NRC conducted this evaluation and issued its  report in December 2016. In addition, Public Law 113-235 also included  a provision for us to review NRC’s security requirements for high-risk  radioactive material. Public Law 113-235 also required us to work with  an independent group of radioactive security experts as part of our  review. This report (1) describes how NRC assesses risk when  establishing security requirements for radioactive material; (2) examines  the extent to which radioactive security experts agreed that NRC’s  assessment of risk includes all relevant criteria for establishing security  requirements; and (3) examines NRC’s 2016 report evaluating its security  requirements for high-risk radioactive material. This report is a public  version of an Official Use Only report that we issued in March 2019.  NRC deemed some of the information in our March report to be Official  Use Only, which must be protected from public disclosure. Therefore, this  report omits all Official Use Only information about types and amounts of  radioactive material. Although the information provided in this report is  more limited, the report addresses the same objectives as the Official Use  Only report and uses the same methodology, which we have described in  less detail to omit references to Official Use Only information.

To describe how NRC assesses risk when establishing security  requirements for high-risk radioactive material, we reviewed documents  addressing how NRC evaluates an RDD, NRC’s study evaluating Part 37  in response to Public Law 113-235, and NRC’s analysis of the risks  posed by high-risk radioactive material. In addition, we interviewed  agency officials at NRC, NNSA, DHS, EPA, and FBI, as well as  academics, agreement state officials, and security managers from  industry about the risks associated with different categories of radioactive  material and how NRC regulates this material.

To examine the extent to which radioactive security experts agreed that  NRC’s assessment of risk includes all relevant criteria for establishing  security requirements, we partnered with the National Academies of  Sciences to identify a balanced group of leading experts in the field of  radioactive security and related issues. The National Academies helped  us identify and select 18 experts representing a broad range of  stakeholders; the experts included federal agency officials, agreement  state officials, academics, representatives of nonprofit organizations,  licensees, industry representatives, international regulators, national  laboratory specialists, and economists. We convened these experts for a  2-day meeting in July 2018. During the meeting, we introduced the threat  of malevolent use of radioactive material, and we asked the experts to  focus their discussion on the potential consequences of an RDD, the  vulnerabilities of radiological materials under current security  requirements, and whether current security requirements were sufficient  given these consequences and vulnerabilities. In addition, we asked the  experts the reasons various radionuclides should be considered high risk,  the reasons these radionuclides should not be considered high risk, and  on balance, whether these radionuclides should be considered high risk.  During the first part of our meeting, we asked experts about a list of  potential consequences from an RDD, the reasons to account for these  consequences when regulating radiological sources, the reasons not to  account for these consequences, and on balance, whether these  consequences should be accounted for when determining regulation for  radiological sources. During the second part of the meeting, we asked  experts to consider four scenarios, each of which was defined by a  specific radioactive material stored under a given set of security controls.  For each scenario, we asked experts to discuss the primary vulnerabilities  and whether Part 37 security requirements were sufficient given those  vulnerabilities and the potential consequences. After the expert meeting,  we conducted a thematic analysis of the information gathered to better  understand the consequences of an RDD using various radioactive  materials.

At our expert meeting, we sought to gather all perspectives on the issues,  and the moderators ensured that experts with differing perspectives had  the opportunity to voice their opinions. We did not include techniques  designed to reach consensus on any topic of discussion because of the  diverse composition of experts and the goal of having a full discussion on  all points of view. Furthermore, some experts brought unique expertise to  the group, and their opinions on certain topics carried more weight than  others with different areas of expertise. For example, a point on the  potential for radioactive material to contaminate a specific area might  have more weight coming from an expert from a national laboratory than  from an expert with an economics background. Experts did not speak on  every topic and did not have the same level of expertise on every topic,  and the meeting format was not designed to quantify the experts’  comments. Therefore, we do not report the number of experts who  agreed or disagreed with various statements. Instead, through our  thematic analysis, we determined that during the expert meeting, experts  made two types of statements on topics with varying degrees of  agreement or corroboration, which we refer to as either “strong evidence”  or “evidence of varying viewpoints.” We considered statements as being  strong evidence when they were made by multiple experts, when the  supporting evidence offered by the experts was sound, when they were  corroborated by other forms of evidence, and when we did not identify  evidence that contradicted it. In this report, we refer to such statements  as “experts generally said,” “experts generally told us,” or “experts  generally agreed.” We considered statements as representing various  viewpoints when credible experts on a given topic provided conflicting  viewpoints, when we found the evidence from both sides to be sound,  evidence from both sides was consistent with other evidence, and experts  who made statements had strong expertise in the area. We refer to these  statements as “some experts said X while other experts said Y.” Appendix  II provides more detail about our analysis.

In addition, we interviewed officials and obtained key documents from  NRC, NNSA, DHS, FBI, and Sandia National Laboratories (Sandia) on  the risk associated with radioactive material. We reviewed academic  research and our previous reports on the components of risk, a 2017  Sandia economic impact study, and two studies Sandia produced for us  in 2018 describing the consequences of RDDs involving a category 1 and  category 3 quantity of a radioactive isotope of concern. We also traveled  to Sandia to interview laboratory officials on the risks associated with  various radioactive materials that could be used in an RDD.

To examine potential weaknesses in NRC’s security requirements that  were established to ensure high-risk radioactive material is safeguarded,  we reviewed previous GAO reports and interviewed officials within the  federal government and representatives of industry to better understand  current security requirements and practices. Specifically, we were  contacted by a working group that represents manufacturers of  radioactive material and companies that use large quantities of  radioactive material in their industrial processes. We spoke with these  officials on various occasions throughout the engagement, and during the  interviews, we solicited these officials’ and industry representatives’  opinions on whether NRC’s current security requirements are sufficient  for ensuring the security of high-risk radioactive material.

We conducted this performance audit from December 2017 to March  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

In September 2003, the United States and other nations endorsed IAEA’s  Code of Conduct, which established basic principles and guidance to  promote the safe and secure use of radioactive material. The Code of  Conduct applies to category 1, 2, and 3 quantities of radioactive  material—all of which are potentially dangerous to human health and  could, if not properly controlled, cause permanent injuries or death to a  person who handled or was otherwise in contact with them. IAEA’s  system considers radioactive material dangerous when gathered in close  proximity to people in sufficient quantity and for a sufficient time to cause  direct human health effects. NRC, working with the Department of  Energy, developed a list of 16 radionuclides of concern that, if gathered in  category 1 or 2 quantities, pose the greatest risk of being used by  terrorists to make an RDD. Of these 16 radionuclides of concern, 4 are  most prevalent in the U.S. economy: americium-241, cobalt-60, cesium- 137, and iridium-192.

Since the terrorist attacks in September 2001, concerns have grown that  terrorists could obtain and use radioactive material and build an RDD.

The risk of an RDD is determined by the function of three components:  threat, vulnerability, and consequence. Threat is generally defined as  entities or actions with the potential to cause harm—including terrorist  attacks. According to NRC officials, there is a general credible threat of  malevolent use of radioactive materials. The second component of RDD  risk, vulnerability, includes physical features or operational attributes that  render an asset open to exploitation, including gaps in security measures  such as gates, locks, perimeter fences, and computer networks. Finally,  the third component of RDD risk, consequence, includes the effects of  terrorist attacks or natural disasters that result in losses to public health  and safety and the economy. Taken together, the three components  make up a “risk triplet,” which is shown in figure 1.

The consequences of detonating an RDD would depend on the quantity  and type of radioactive material used and the size and characteristics of  the area in which the material was dispersed. An example of the  consequence of an RDD occurred in 1987 when two people in Goiânia,  Brazil, found an abandoned medical machine containing 1,400 curies of  cesium-137. The individuals, who were unaware of the nature of the  radioactive material, extracted it from the machine and distributed the  material to several families, causing 20 people to be hospitalized and four  deaths. The very high internal and external contamination was caused by  the way they handled the cesium-137, including rubbing their skin with the  material and eating with contaminated hands. In addition, 112,000 people  in the surrounding area were monitored for exposure to radiation, of  which 249 were found to be internally or externally contaminated. The  accident also contaminated 85 houses and required the demolition of  homes and other buildings, generating 3,500 cubic meters of radioactive  waste. This example shows the range of consequences from the  dispersal of radioactive material, from fatalities to socioeconomic  effects. Potential consequences of an RDD are outlined in figure 2.

Depending on the size and radioactivity of an RDD, the affected  population could be evacuated and possibly relocated. EPA’s Protective  Action Guide (PAG) presents radiation dose guidelines that are used by  federal agencies to protect people from unhealthy levels of radiation.  According to the PAG, evacuation is recommended when there is enough  radiation to reach 5.0 rem over the first 4 days. The PAG also outlines  actions that can be taken in response to projected radiation dose rates,  including evacuation, shelter in place, relocation, and avoidance of  drinking water or food supplies. The PAG does not consider a specific  geographic area, such as a square kilometer, when recommending  evacuation.

Domestically, the Atomic Energy Act of 1954, as amended, gives NRC  primary responsibility for regulating most domestic industrial, medical,  and research uses of radioactive material to protect public health and  safety, among other things. NRC is composed of five Commissioners (the  Commission) appointed by the President and confirmed by the Senate for  5-year terms. One of the Commissioners is designated by the President  to be the Chairman and official spokesperson of the Commission.  According to NRC’s website, the Commission formulates policies,  develops regulations governing nuclear reactor and nuclear and  radioactive material safety, issues orders to licensees, and adjudicates  legal matters. Issues before the Commission are decided by majority  vote, and the Commission directs subsequent actions be implemented by  NRC staff.

NRC Periodically Assesses Risk When Establishing Security Requirements for Radioactive Material

When establishing security requirements for radioactive material, since  2004, NRC has assessed the risks of such material based on the  potential of that material to cause prompt fatalities and the deterministic  health effects from its radiation; it has not used socioeconomic  consequences as a basis for establishing regulations related to the  security of radioactive material. Moreover, in response to the  recommendations we made in 2016 that NRC should better track  category 3 quantities of radioactive material, NRC staff assessed  whether they should require additional security measures for category 3  radioactive material and determined that such material did not merit  additional security measures.

NRC Considers Prompt Fatalities and Deterministic Health Effects When Assessing the Risk of an RDD and Does Not Consider Socioeconomic Consequences

Since 2004, NRC has assessed the risks of radioactive material based on  the potential of that material to cause prompt fatalities and deterministic  health effects from radiation. NRC on several occasions reassessed and  repeatedly reaffirmed its use of the occurrence of prompt fatalities and  deterministic health effects as its primary criteria for measuring the  consequences of an RDD, including when developing its decision-making  framework in 2004, reviewing its regulatory framework after the  Fukushima nuclear disaster in 2011, and in its 2014 response to  recommendations from the Radiation Source Protection and Security  Task Force (the Task Force).

NRC first considered prompt fatalities from radiation as criteria for  measuring consequences in November 2004 when developing its  decision-making framework for evaluating vulnerabilities for theft of  radioactive material. Specifically, in 2004 NRC staff recommended that  the Commission approve a decision-making framework that assessed risk  based on prompt fatalities from radiation. In the Commission Paper,  NRC staff stated that the framework would employ the consequence  criteria of preventing prompt fatalities from radiation exposure, but they  also recognized that including additional consequence criteria, such as  land contamination, might be warranted. They also pointed out that  DHS’s Risk Analysis and Management for Criteria Asset Protection  framework used criteria including economic, environmental, and loss of  output of production capability, among other things. In January 2005,  the Commission approved using prompt fatalities from radiation for  measuring consequence. In its decision, the Commission also said that  NRC staff should not independently develop criteria and standards for  other consequences, such as land contamination and economic impacts.

After the Fukushima nuclear disaster in 2011, NRC staff again considered  broadening the criteria for assessing risk to include socioeconomic  impacts. Specifically, in an August 2012 analysis presented to NRC  commissioners in response to Fukushima that addressed whether NRC’s  regulatory framework should be modified to consider economic  consequences, NRC staff noted that NRC’s existing requirements have  the effect of minimizing economic consequences by preventing or  mitigating events that could lead to a radioactive release. The analysis  prepared by NRC staff recommended improving guidance for estimating  offsite economic costs based on up-to-date data. In March 2013, the  Commission approved the staff’s recommendation to provide enhanced  guidance but found that socioeconomic consequences should not be  considered. at 2 rem  for the first year. socioeconomic consequences to the Commission in January 2014,  reiterating the staff’s view that Part 37 provides adequate security  protection against a significant RDD. The NRC staff also concluded that  the current protection and security framework and posture adequately  protects against contamination and resulting economic consequences.

NRC Assessed the Risk Associated with Category 3 Material and Determined That No Additional Security Measures Are Needed

In 2016, NRC established the Category 3 Source Security and  Accountability Working Group (the Working Group) in response to our  2016 recommendations to NRC to better track dangerous quantities of  radioactive material. This group issued a report in 2017 assessing  whether NRC should require additional security measures for category 3  material and determined that such material did not meet the threshold of  prompt fatalities and deterministic health effects set by NRC, and  therefore, did not require additional security measures. As part of its  analysis, the Working Group stated that a category 2 quantity of a certain  radioactive material would not be sufficient to achieve an RDD of  consequence that would cause deterministic health effects. NRC  officials also told us that there is not enough of this same radioactive  material in the United States to create an RDD of consequence even if all  of it was used in an RDD. The Working Group also concluded that there  is no evidence of adversarial interest in acquiring category 3 quantities of  material by theft, that security weaknesses at facilities that contain  category 3 quantities of radioactive material had not increased since first  evaluated by NRC, and the consequences of an RDD using category 3  material are not significant enough to require additional security  measures.

Based on the findings of the working group’s report, NRC staff  recommended that the Commission not amend regulations to require  license verification of category 3 radioactive material or impose security  requirements to prevent the aggregating of category 3 material to a  category 2 quantity. The report did recommend that the Commission  approve the pursuit of rulemaking to require safety and security  equipment be in place before granting a license for an unknown entity  and clarify license verification methods for transfers involving quantities of  radioactive material below the category 2 threshold.

Experts Generally Agreed That NRC’s Assessment of Risk Does Not Include All Relevant Criteria for Establishing Security Requirements

The experts we convened with assistance from the National Academies  generally agreed that NRC’s assessment of risk does not include the all  relevant criteria for establishing security requirements. The experts at  our meeting generally agreed that prompt fatalities from radiation and  deterministic health effects are not the only relevant criteria for  determining the consequences of an RDD, which recent studies we  reviewed support. These experts and studies generally agreed that  socioeconomic effects and fatalities from subsequent evacuations are  relevant criteria for assessing the consequences of an RDD.

Experts Generally Agreed and Studies Support That Prompt Fatalities and Deterministic Health Effects Have Limited Value as Criteria

The experts at our meeting generally agreed that using prompt fatalities  and deterministic health effects from radiation as the basis for analyzing  consequence have limited value to NRC as criteria for determining the  consequences of an RDD, as they are unlikely to occur in the event of an  RDD. Experts generally said at our meeting expressed the opinion that  NRC is not focusing on all relevant criteria for assessing consequence.  For example, one expert from the regulatory community said that prompt  fatalities are an unlikely consequence of an RDD. Another expert affiliated  with users of radioactive material noted that deterministic health effects  from an RDD are limited. Finally, a security expert said that it would be  difficult to kill large numbers of people with an RDD, and therefore prompt  fatalities are not a good measure of consequence. Another expert pointed  out that NRC’s current criteria would be unlikely to support regulating  category 1 and 2 materials since an RDD with these materials is unlikely  to cause prompt fatalities. He added that this creates a disconnect where  category 3 material is ignored, but NRC regulates category 1 and 2  material even though category 1 and 2 materials do not meet NRC’s  criteria of causing prompt fatalities and deterministic health effects.

Recent studies from Sandia also show that prompt fatalities and  deterministic health effects are unlikely to result from an RDD.  Specifically, Sandia completed two studies in 2017 and 2018 that  modeled an RDD blast and evaluated the potential consequences in New  York City. The 2017 study modeled the potential consequences of a  category 1 quantity of radioactive material detonated in an RDD and  estimated that there would likely be no prompt fatalities from radiation.  The 2018 study undertook the same analysis with a category 3 quantity of  radioactive material and estimated that it would also produce no prompt  fatalities from radiation.

Experts Stated and Studies Support That Socioeconomic Effects and Fatalities Resulting From Evacuations Are Relevant Criteria for Determining the Consequences of an RDD

The experts who participated in our meeting discussed what type of  consequences should be considered and generally agreed that  socioeconomic effects and fatalities from subsequent evacuations, rather  than prompt fatalities and deterministic health effects, are relevant criteria  for NRC to consider when assessing the consequences of an RDD, which  recent studies we reviewed support. For example, one expert said that  while deterministic health effects from an RDD are limited, socioeconomic  impacts are significant. Another expert said that the main point of a  terrorist detonating an RDD is to create economic effects, not  deterministic health effects. This expert added that the dispersal of  radioactive material would result in low-level radiation scattered across an  area, leading to socioeconomic consequences. A participating expert  from the regulatory community said that it is difficult to quantify  socioeconomic effects. Furthermore, the expert said that any model used  to determine regulation by predicting consequence must be reproducible.

The federal government has recently taken steps to better understand the  socioeconomic costs associated with an RDD. For example, Sandia  studies completed in 2017 and 2018 estimated socioeconomic costs for  RDDs with category 1 and category 3 quantities of radioactive material.  The 2017 study that modeled a category 1 quantity of radioactive material  estimated that the socioeconomic impact on the national gross domestic  product would be approximately $30 billion. The 2018 study, which  substituted a category 3 quantity of radioactive material, estimated the  socioeconomic impact on gross domestic product at $24 billion. One  expert noted that the estimates may be understated. Specifically, the  2017 Sandia study took into account that the facades of some buildings in  New York City could be replaced, which would aid cleanup and reduce  socioeconomic costs. However, one expert who attended our meeting  said that New York City may be a best-case example of an urban target  because the city has solid response plans and modern buildings with  facades that can be removed more easily than those in other cities. This  expert said these factors likely lead to an optimistic calculation of  socioeconomic consequence in the study, due to the preparation and  resilience posture of New York City, creating a best-case scenario  regarding cleanup that may not accurately quantify costs in other cities. In  this expert’s view, the federal government may also be underestimating  the economic consequences of an RDD by not accounting for the  potential that local cleanup standards may be more stringent than the  federal government standards assumed in the study. The expert said that  locals will always want to clean up to a higher standard than federal  government guidance recommends, largely due to a desire to protect  economic assets such as trade, brand, and image.

In addition to socioeconomic concerns, experts who attended our meeting  generally noted that an assessment of the consequence of an RDD  should consider fatalities resulting from the evacuation of homes and  business. For example, one expert from our meeting said that there were  few deaths from radiation during the incident at the Fukushima nuclear  complex in 2011, but there were many deaths from the evacuation.  Another expert agreed and said that there is evidence from Chernobyl  and Fukushima linking health effects to evacuations and that, therefore,  fatalities from evacuations should be included on the list of consequences  from an RDD. A third expert said that panic cannot be underestimated in  the event of an RDD, and the consequences of evacuation and relocation  would exceed prompt fatalities and deterministic health effects. Finally,  one expert said that many people outside of the evacuation area will also  choose to relocate after an RDD rather than wait for direction from the  government, which could increase the number of evacuees and lead to  additional fatalities.

The 2017 and 2018 Sandia studies support these concerns, estimating  that these evacuations could cause hundreds to thousands of deaths and  that fatalities during evacuations are similar for RDDs using category 1  and category 3 quantities of the same material. Specifically, the 2017  Sandia study examined the number of fatalities that occurred during the  evacuation from the disaster at the Fukushima nuclear complex. Using  that event as a baseline, the Sandia study estimated that approximately  1,500 people could die from the evacuation associated with the  detonation of an RDD containing a category 1 quantity of radioactive  material in New York City. The 2018 Sandia study of a detonation of an  RDD containing a category 3 quantity of radioactive material estimated  that approximately 800 people could die from the evacuation.

NRC does not consider socioeconomic consequences or fatalities from  evacuations when assessing the consequence of an RDD. Agency  officials told us that, under the authority of the Atomic Energy Act, NRC  staff has discretion to consider other criteria, including socioeconomic  effects, if so directed by the Commission. However, NRC staff told us that  they do not currently consider socioeconomic consequences as criteria  because they have been specifically directed not to do so by the  Commission. In discussions with agency officials, it is unclear why the  Commission has directed the NRC staff not to consider other criteria for  evaluating the impact of an RDD. NRC’s own guidance states that RDDs  would cause few deaths from radiation but result in significant  socioeconomic impacts. Specifically, NRC guidance issued in May 2014  states: “RDDs are considered weapons of mass disruption; few deaths  would occur due to the radioactive nature of the event; however,  significant social and socioeconomic impacts could result from public  panic, decontamination costs, and the denial of access to infrastructure  and property for extended periods of time.” NRC’s decision to not  consider other criteria has limited its assessments of risk presented by  the use of radioactive material in an RDD. By considering socioeconomic  impacts and fatalities resulting from evacuations in its criteria, NRC would  have better assurance that it was considering the more likely and more  significant consequences of an RDD when establishing its security  requirements for this material.

NRC’s 2016 Report Does Not Fully Reflect the Risks of High-Risk Category 3 Material, Collocation of Americium-241, and Protection against Insider Threats

In 2016, NRC evaluated the effectiveness of Part 37, as required by  Public Law 113-235, and concluded that the rule is effective for ensuring  category 1 and 2 radioactive materials are secure from theft or diversion.  However, experts who attended our meeting stated, and recent studies  support, that if category 3 quantities of radioactive materials were used in  an RDD, the consequences could be comparable to a category 1 or 2  quantity of the same material, which are protected from theft by additional  security measures. In addition, experts who participated in our meeting  generally said that NRC’s current requirements permit collocation at the  same facility of multiple category 3 quantities of americium-241 that in  total reach or surpass the threshold for a category 2 quantity without the  enhanced security required for category 1 and 2 materials. Furthermore,  experts generally agreed that there are security weaknesses in the  current trustworthiness and reliability process to protect against an insider  threat.

NRC’s 2016 Evaluation of Part 37 Determined That Current Security Requirements are Adequate for Category 1 and 2 Radioactive Materials

In December 2016, NRC issued a report evaluating the effectiveness of  Part 37, as required by Public Law 113-235. NRC’s evaluation included  an analysis of events and inspection findings related to the security of  category 1 and 2 materials, including an analysis of 189 violations issued  to NRC State licensees from March 2014 through March 2016. The report  found that almost all of the violations were related to conducting  background investigations, controlling access to radioactive material, and  physical security measures. The violations mainly occurred when  licensees had not yet implemented Part 37 or failed to fully document how  their security program complied with Part 37. The report noted that there  were no Severity Level I or Severity Level II violations.

The NRC report looked at the theft of six category 2 quantities of  radioactive material since the introduction of the Increased Controls  security requirements in 2003 and concluded that carelessness or human  error, rather than any gaps in the requirements of Part 37, contributed to  the thefts. As we reported in 2014, the thefts included industrial  radiography cameras with category 2 quantities of iridium-192 sources  stolen from radiography trucks parked outside a company facility, in hotel  parking lots, and at a gas station. NRC concluded that in all the events,  carelessness or human error contributed to the thefts and had the  licensees followed existing regulatory requirements, the thefts could have  been prevented.

NRC’s 2016 report concluded that better outreach and communication  would help improve compliance with Part 37. NRC’s report also  documents NRC staff’s determination that the requirements in Part 37 are  effective in preventing the theft or diversion of category 1 and 2 quantities  of radioactive material. NRC determined that potential rule clarifications  and guidance initiatives could help to enhance the clarity and  effectiveness of the rule, ensure better understanding of security  expectations, and allow for more complete and adequate implementation.  NRC’s overall assessment is that Part 37 provides reasonable assurance  for the security of category 1 and 2 quantities of radioactive material by  protecting the material from theft or diversion.

NRC’s 2016 Evaluation Did Not Consider the Security of Category 3 Material That Experts Consider High Risk

In conducting its evaluation, NRC examined past security incidents and  inspection reports, but its report did not review the security requirements  for category 3, 4, or 5 quantities of radioactive material because NRC  does not consider these categories to be a significant risk. NRC chose  to define high-risk radioactive material as only category 1 and 2. NRC  does not further elaborate why it took this approach.

NRC’s reliance on prompt fatalities and deterministic health effects and its  exclusion of socioeconomic consequences and deaths from evacuations  as criteria for determining the consequences of an RDD, as discussed  earlier, has resulted in security requirements that do not include all high- risk quantities of some radioactive materials. Experts who participated in  our meeting generally agreed that some category 3 quantities of  radioactive material should be considered high risk based on their  potential consequences if used in an RDD. For example, one international  expert pointed out that IAEA guidance includes security measures for  category 3 quantities of material and expressed surprise that U.S.  guidelines do not include additional security measures for category 3  quantities. Another expert suggested that NRC include category 3  quantities of radioactive material in the National Source Tracking System,  which would allow for license verification during purchases. In this  expert’s opinion, the main vulnerability for category 3 quantities of  radioactive material is that they can be purchased with a license that has  not been verified as legitimate by the NRC or an agreement state.

The experts also generally said that some category 3 radioactive material  should be considered high risk and should be subject to additional  security measures. For example, one expert suggested that some types  of category 3 radioactive material may need additional oversight.

However, this expert said that NRC should consider a more nuanced  approach to increasing the security for some, but not all, quantities of  category 3 radioactive material. Another expert agreed and said that the  ability to disperse material is a primary factor in determining if something  is high risk. For this reason, this expert said, category 3 quantities of  some types of radioactive material should be considered high risk, and  there may be need for an additional category of materials that falls below  category 2 but that includes the most dangerous high-risk materials in  category 3 quantities. An expert who attended our meeting stated that  certain radioactive materials pose a unique decontamination challenge  because those materials bind to materials like asphalt and concrete,  making decontamination difficult and expensive. One expert said that the  consequences listed in the 2018 Sandia report were enough to justify  requiring additional security measures for category 3 quantities of certain  radioactive materials. As shown in table 1, the 2018 Sandia study found  that a category 3 quantity of radioactive material could result in  socioeconomic consequences and fatalities from evacuations similar to  an RDD with a category 1 quantity of radioactive material.

The experts also generally said that there could be long-term  socioeconomic consequences unique to the risk posed by an RDD that  used a category 3 quantity of radioactive material, and certain radioactive  materials in smaller quantities should be considered high risk. As we  described earlier, NRC reported in a 2017 Threat, Consequence, and  Vulnerability Assessment that even if several hundred category 3  quantities of a certain radioactive material were used in an RDD, it would  not create an RDD of consequence. In our discussions with NRC staff,  they expanded on this point and stated that there may not be enough of  this material in the United States to build an RDD of consequence.  However, new research from Sandia found that a category 3 quantity of  the same material could trigger an evacuation and result in significant  socioeconomic consequences.

According to an expert from the regulatory community, while the  Commission has considered requiring additional security measures for  category 3 quantities of material, NRC staff recommended against doing  so because the costs of providing additional security would outweigh the  benefits. For example, one expert who attended our meeting said that the  choice is between the difference in costs of absolute security and  adequate security, and the cost/benefit analysis does not support  including category 3 quantities of radioactive materials in Part 37. The  expert pointed out that there have been relatively few thefts of category 3  sources in the United States and suggested that providing additional  security should be weighed against the low likelihood that the radioactive  materials would be stolen.

While there were differing views in our expert meeting between the  regulatory community and other experts, the experts generally agreed,  and the Sandia studies support, that the consequences of category 3  quantities of certain types of material could be significant. By requiring  additional security measures for these high-risk quantities of category 3  material, and assessing whether other category 3 radioactive materials  should also be safeguarded with additional security measures, NRC could  have better assurance that its requirements are sufficient to help ensure  all high-risk radioactive material is protected from theft and use in an  RDD.

NRC’s 2016 Report Does Not Fully Address Weaknesses in Part 37’s Regulation of the Collocation of Americium- 241 and How NRC Protects against an Insider Threat

NRC’s 2016 report looked at the risks posed by the collocation of  category 3 quantities of material and insider threats. NRC concluded that  rule clarifications and additional guidance could help enhance clarity and  effectives of the rule, but its report does not fully address how these risks  should be managed. For example, experts who participated in our  meeting generally agreed that weaknesses continue to exist in how Part  37 regulates the collocation of multiple category 3 quantities of  americium-241 at a single facility. Specifically, NRC requirements permit  collocation of multiple category 3 quantities of material that in total reach  a category 1 or 2 quantity of material, without applying Part 37. Experts  told us that well logging companies, which use americium-241 to inspect  wells for oil and natural gas, are storing multiple category 3 quantities,  each just below the threshold for category 2, of americium-241 at the  same facility; thus, the total quantity does not trigger additional security  requirements under Part 37. Figure 3 shows a well logging storage facility  containing multiple category 3 quantities of americium-241.

Experts at our meeting generally said that collocation of multiple  quantities of category 3 americium-241 at well logging facilities creates  specific security weaknesses that should be addressed. For example, one  expert who attended our meeting from the regulatory community said that  NRC has no formal definition for collocation, but Part 37 considers it  acceptable to store multiple category 3 quantities of radioactive material  in separate, locked containers that, together, add up to a category 2  quantity. Another expert pointed out that when NNSA evaluates threats to  materials, it totals up the quantity of materials located at the same facility  to determine the total amount of material at risk. A third expert noted that  licensees are required to inventory category 3 quantities of material only  twice per year. Furthermore, the experts pointed out that these types of  facilities are not subject to stricter security requirements, and therefore,  do not undertake trustworthiness and reliability evaluations for their  employees with unescorted access to radioactive material. By requiring  that all licensees implement additional security measures when they  collocate multiple quantities of category 3 americium-241—that in total  reach a category 1 or 2 quantity—at a single facility, NRC could have  better assurance that the material is protected from theft and use in an  RDD.

Furthermore, experts who participated in our meeting generally agreed  that there continue to be security weaknesses in the current  trustworthiness and reliability process for securing radioactive material  from theft and use in an RDD. For example, one expert from the licensee  community who attended our meeting said that NRC’s Part 37 does not  go far enough in ensuring the trustworthiness and reliability of individuals  given unescorted access. Specifically, the expert said that, based on the  Part 37 requirements, licensees make all trustworthiness and reliability  determinations for granting unescorted access to employees, which leads  to inconsistencies across licensees. The experts generally said that NRC  should give licensees more guidance on acceptable criteria for granting  unescorted access, which is consistent with recommendations included in  past GAO reports. NRC is currently in the process of making revisions  to its trustworthiness and reliability guidance.

Experts who attended our meeting said that licensees face challenges in  making trustworthiness and reliability determinations, including the fear of  being sued if they deny employment to an individual with a criminal  record, difficulty conducting background investigations for foreign  nationals, and the potential for individuals to be radicalized more quickly  than the current trustworthiness and reliability process protects against.  One expert from the regulatory community who attended our meeting said  that trustworthiness and reliability decisions are a “judgment call,” and  when an applicant has a criminal record or has committed a felony, a  company may not want to give them unescorted access to radioactive  material. However, the expert added that denial of unescorted access  without backup from NRC guidance may leave the company open to  lawsuits. In addition, another expert who attended our meeting said  institutions that often employ foreign nationals as researchers, such as  hospitals, struggle with verifying limited background information for these  individuals. Finally, an expert who attended our meeting said that  perception of trustworthiness and reliability has recently changed, and  there is now greater concern that people can be radicalized quickly,  rendering background investigations insufficient to identify potential  issues with an employee’s trustworthiness and reliability during their  employment. The expert told the group that there is evidence that  individuals can be radicalized in a matter of months. The expert said that  current trustworthiness and reliability procedures should take into account  that people’s beliefs can change rapidly.

Radioactive material is used in thousands of locations throughout the  United States for medical, industrial, and research purposes. On several  occasions over the past 20 years, NRC has examined and revised the  security requirements for these materials in order to prevent terrorists  from acquiring radioactive material and constructing an RDD, or “dirty  bomb.” When assessing the risk posed by an RDD, NRC has repeatedly  looked at different criteria for measuring consequences and chose to  base its decisions primarily on preventing prompt fatalities and  deterministic health effects from radiation. However, the experts who  participated in our meeting generally agreed, and Sandia studies support,  that socioeconomic effects and fatalities from subsequent evacuations  are relevant criteria for assessing the consequences of an RDD. NRC’s  decision to not consider other criteria to assess the consequence of an  RDD has resulted in security requirements that do not address the full  risks presented by the danger that category 3 quantities of some  radioactive material could be used in an RDD to cause significant  socioeconomic consequences comparable to what could be caused by  category 2 or category 1 quantities of material. By considering  socioeconomic impacts and fatalities resulting from evacuations in its  criteria, NRC would have better assurance that it was considering more  likely and more significant consequences of an RDD when establishing its  security requirements for this material.

Furthermore, Part 37 requires enhanced security measures for categories  1 and 2 quantities of radioactive material and does not require additional  security for category 3, 4, and 5 quantities of material beyond existing  safety requirements. Although NRC chose to limit its 2016 evaluation of  Part 37 to only category 1 and 2 quantities of material, experts who  participated in our meeting generally said that they consider certain  category 3 quantities of radioactive material high risk based on their  potential consequences if used in an RDD, and data from recent studies  support this determination. By requiring additional security measures for  these high-risk quantities of category 3 material, and assessing whether  other category 3 radioactive materials should be safeguarded with  additional security measures, NRC can have better assurance that its  requirements are sufficient to help ensure all high-risk radioactive material  are protected from theft and use in an RDD.

In addition, NRC’s 2016 report looked at the risk posed by the collocation  of category 3 quantities of material and concluded that rule clarifications  and additional guidance could help enhance the clarity and effectiveness  of the rule. However, the report does not fully address how this risk  should be resolved. Current NRC security requirements permit the  collocation of multiple category 3 quantities of material that in total reach  a category 2 quantity of material or higher, without triggering additional  security requirements under Part 37. By requiring that all licensees  implement additional security measures when they collocate multiple  quantities of category 3 americium-241—that in total reach a category 1  or 2 quantity—at a single facility, NRC could have better assurance that  the material is protected from theft and use in an RDD.

We are making the following three recommendations to the Nuclear  Regulatory Commission:

The Chairman of NRC should direct NRC staff to consider  socioeconomic consequences and fatalities from evacuations in the  criteria for determining what security measures should be required for  radioactive materials that could be used in an RDD.  (Recommendation 1)

The Chairman of NRC should require additional security measures for  high-risk quantities of certain category 3 radioactive material, and  assess whether other category 3 materials should also be  safeguarded with additional security measures. (Recommendation 2)

The Chairman of NRC should require all licensees to implement  additional security measures when they have multiple quantities of  category 3 americium-241 at a single facility that in total reach a  category 1 or 2 quantity of material. (Recommendation 3)

We provided a draft of this report to the Chairman of NRC, the  Administrator of NNSA, the Secretary of the Department of Homeland  Security, and the Attorney General of the United States. NRC provided  written comments on the draft report, which are presented in appendix III.  In addition, NRC provided technical comments, which we incorporated as  appropriate. NNSA, DHS, and FBI did not provide written comments.

NRC disagreed with two of our recommendations and neither agreed nor  disagreed with an additional recommendation. Specifically, it disagreed  with our recommendations that it (1) consider socioeconomic  consequences and fatalities from evacuations when determining security  measures for radioactive materials; and (2) require licensees to  implement additional security measures when they have multiple  quantities of category 3 americium-241 at a single facility that in total  reach a category 1 or 2 quantity. NRC stated that it is considering an  additional recommendation that it require additional security measures for  high-risk quantities of category 3 materials.

Regarding the first recommendation with which NRC disagreed, the  agency stated that its current regulatory requirements provide for the safe  and secure use of radioactive materials, and that we only focused on  potential consequences of an RDD without consideration of the two other  elements of risk—threat and vulnerability. We disagree. NRC agrees that  a general threat exists, and this report, in combination with our previous  reports, demonstrate that there are vulnerabilities in current NRC security  requirements and that the potential consequences of misusing these  materials could be significant. Furthermore, the report discusses new  evidence related to the consequence of an RDD that NRC has not yet  considered. For the second recommendation with which it disagreed,  NRC stated that it has already considered the issue of aggregation of  radioactive material and has taken or is in the process of taking actions to  clarify relevant guidance and procedures. Again, we disagree. We  acknowledge that NRC is taking action to better educate licensees on  how to comply with requirements related to aggregation. However, these  actions do not address the issue of licensees taking advantage of NRC’s  security requirements which permit the storing of multiple category 3  quantities that are just below the threshold for category 2 at the same  facility. Finally, for the NRC recommendation to consider additional  security measures for high-risk quantities of category 3 materials, the  agency said that it has been considering our recommendation in  connection with its response to the recommendations in GAO-16-330.  However, after we issued GAO-16-330, NRC staff subsequently  recommended that the NRC Commission not implement the  recommendations from that report.

NRC stated that our report and recommendations lack important context  in that we did not consider all aspects of risk—threat, vulnerability, and  consequences. We disagree. First, as the report states, NRC agrees that  a general threat exists for the theft and misuse of radiological materials.  Second, the report also states that we have addressed vulnerability in  several past GAO reports that provide examples of how the controls that  NRC and others have put in place to prevent the theft or misuse of these  materials are not always implemented correctly. In fact, we found gaps in  these controls each time we reviewed the security of radioactive  materials. These gaps in controls create vulnerabilities. Having discussed  threat and vulnerability, this report adds important new information  concerning the consequences of an RDD. In this regard, both the Sandia  studies and the results from our National Academy of Sciences expert  meeting show that prompt fatalities from radiation are unlikely to occur if  an RDD is detonated, while the same event could result in tens of billions  of dollars in economic damage and potentially hundreds to thousands of  deaths from evacuations.

NRC also stated that our evidence was insufficient for recommending  regulatory and policy changes. Specifically, they said that the Sandia  studies (1) were based on scenarios that were not probable, (2) did not  credit existing protective measures to prevent an RDD, and (3) were not  subjected to a formal review and endorsement process. In addition, they  said that the views expressed by experts who attended our National  Academy of Sciences meeting resulted in conclusions that were not fully  supported. We disagree with these characterizations of the studies and  our expert meeting. Specifically, the Sandia studies did not attempt to  assess existing security measures for radioactive material or the  probability or likelihood of an RDD. These Sandia studies examined the  consequences of an RDD and represent the most recent research on  RDD consequences from an independent and reliable source. In addition,  NRC’s claim that the Sandia studies were conducted without a formal  review and endorsement process is misleading. Specifically, according to  NNSA officials, Sandia and NNSA officials met with officials from NRC,  DHS, and EPA, among others, to discuss and gather input on the  assumptions to be used in the 2017 Sandia study. During this meeting,  according to NNSA officials, NRC staff provided input on key assumptions  and subsequently provided data to help support the Sandia study. In  addition, NNSA and Sandia briefed their interagency partners, including  NRC, about the findings in the study before publishing and received  generally positive feedback on their results. Furthermore, we partnered  with the National Academies to identify and select a broad range of  experts in the field of radioactive material security, including federal  agency and agreement state officials; academics; representatives of  nonprofit organizations, licensees, and industry; international regulators;  and national laboratory specialists. For additional information on how we  developed, held, and analyzed data from our National Academy of  Sciences expert meeting, please refer to appendix 2.

NRC’s comments also state that GAO does not account for the work of  the 2014 Radiation Source Protection and Security Task Force (the Task  Force), which considered economic consequences related to an RDD.  However, as noted in our report, NRC’s response to the Task Force’s  recommendations said that NRC staff would need additional direction  from the Commission to consider examining alternative consequences. In  addition, in 2014, NRC staff recommended that NRC not consider  changing the policy to include consideration of socioeconomic  consequences to the Commission, reiterating the staff’s view that Part 37  provides adequate security protection against a significant RDD. Today,  NRC staff still does not have direction from the Commission to consider  socioeconomic effects when setting security requirements. We think that  needs to change in order for NRC to conduct a complete analysis of the  consequences of an RDD.

Finally, NRC stated that a significant gap related to the security of  category 3 sources has not been identified. We disagree. As noted in the  report, requirements for the security of category 3 quantities of radioactive  materials are significantly less stringent than those required for category 1  and 2 quantities of material. Nevertheless, our report shows that the use  of category 3 quantities of certain radioactive materials in an RDD may  have comparable socioeconomic consequences. Furthermore, previous  GAO reports have repeatedly shown that gaps exist related to the  security of category 3 and higher radioactive material.

We are sending copies of this report to the appropriate congressional  committees, the Chairman of the U.S. Nuclear Regulatory Commission,  the Secretary of Energy, the Secretary of Homeland Security, the  Administrator of the Environmental Protection Agency, and the Attorney  General of the United States, and other interested parties. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-3841 or trimbled@gao.gov. Contact points for our offices  of Congressional Relations and Public Affairs are on the last page of this  report. GAO staff who made key contributions to this report are listed in  appendix IV.

We focused our review primarily on the Nuclear Regulatory Commission  (NRC) because it is the principal federal agency with responsibility for  licensing the commercial use of and regulating the security of radioactive  materials in the United States. Additionally, Public Law 113-235  specifically directs us to review NRC’s security requirements for  radioactive material. We also interviewed officials at various agencies that  play a role in radioactive material security, including the National Nuclear  Security Administration (NNSA), the Department of Homeland Security  (DHS), the Environmental Protection Agency (EPA), and the Federal  Bureau of Investigation (FBI). We interviewed officials at NNSA because  NNSA’s Office of Radiological Security provides upgrades and  enhancements to NRC licensees and removes and disposes of disused  radioactive material. We also spoke to DHS officials because DHS is the  primary federal agency for implementing domestic nuclear detection  efforts for a managed and coordinated response to radioactive and  nuclear threats. Additionally, we interviewed officials at EPA, because the  agency developed the Protective Action Guide (PAG) manual, which  contains radiation dose guidelines that would trigger public safety  measures. Finally, we interviewed the FBI, which offered us information  on the potential threat related to radioactive material security. In addition  to federal agencies, we were contacted by and spoke to a working group  that represents the commercial radioactive source industry and received  a briefing from a company, which is also a member of the working group  that utilizes large panoramic irradiators.

We received a series of risk briefings from federal agencies to collect  information on current risks related to radioactive material security. NRC  officials provided us with information about how the agency evaluates  risks associated with radioactive material, including the threat,  vulnerability, and consequence of an adversary acquiring and using  radioactive material in a radioactive dispersal device (RDD). DHS officials  provided us with a risk briefing on current threats to radioactive material  and potential consequences of an RDD attack. Specifically, those officials  briefed us on historical terrorist interest in using radioactive materials in  attacks. NNSA officials and Sandia National Laboratory experts in  radioactive security and consequence modeling briefed us on potential  economic consequences from an RDD, which they based on an  economic impact study completed by Sandia in 2018. Finally, FBI officials  gave us a threat briefing focused on current radioactive material security  threats, including interest by adversaries in conducting an RDD attack.  These briefings were held at a classified level.

In order to fulfill the Public Law 113-235 requirement to work with an  independent group of experts, we partnered with the National Academies  of Sciences to convene a group of experts on radioactive material  security on July 26 and 27, 2018. We determined that this method offered  the best means of gathering a balanced group of leading experts in the  field of radioactive security to discuss issues in a moderated setting. In  addition, this method allowed us to implement a structured and  systematic approach when gathering evidence. Specifically, our  methodology for the meeting included selecting a broad range of experts  to participate in the meeting, administering a written questionnaire to the  experts before the meeting, designing specific scenarios used during the  moderated discussion, and performing a thematic analysis upon  completion of the meeting.

To describe how NRC assesses risk when establishing security  requirements for high-risk radioactive materials and how it chose to  primarily consider prompt fatalities as criteria for measuring  consequences of an RDD, we reviewed NRC documents addressing how  NRC evaluates an RDD, NRC’s study evaluating the effectiveness of Part  37 in response to Public Law 113-235, and NRC’s analysis of the risks  posed by high-risk radioactive materials. Specifically, we reviewed NRC  Commission Papers and NRC responses to actions taken by the  Radiation Source Protection and Security Task Force. We also conducted  interviews with agency officials at NRC, NNSA, DHS, EPA, and FBI, as  well as academics, agreement state officials, and security managers from  industry about the risks associated with different categories of radioactive  materials and how NRC regulates these materials. We selected  interviewees based on their expertise, but the results of these interviews  are not generalizable.

To examine the extent to which radioactive security experts agreed that  NRC’s assessment of risk includes all relevant criteria for establishing  security requirements, we partnered with the National Academies to  identify and select a broad range of experts in the field of radioactive  material security, including federal agency and agreement state officials;  academics; representatives of nonprofit organizations, licensees, and  industry; international regulators; and national laboratory specialists. In  choosing the group of 18 experts, we specifically chose individuals with a  diversity of backgrounds on topics. This ensured a balanced range of  opinions and specific expertise on given topics but did not represent a  generalizable sample of experts on a specific topic. For example, some  individuals had specific expertise in certain topics and could provide a  more insightful perspective than others in the group.

In advance of the meeting, we developed a written questionnaire to obtain  the experts’ views on the key threats, vulnerabilities and consequences of  materials regulated under Part 37 and those not regulated under Part 37.  We administered the questionnaire to the experts via email and obtained  completed questionnaires from all of them. We analyzed their responses  to focus the topics we discussed during our two-day meeting. During the  meeting, we introduced the threat of malevolent use of radioactive  material, and we asked the experts to focus their discussion the potential  consequences of an RDD, the vulnerabilities of radiological materials  under current security requirements and whether current security  requirements were sufficient given these consequences and  vulnerabilities. We asked them to discuss the reasons to account for the  consequence in the regulation of radioactive material, the reasons not to  account for the consequence, and whether the consequence should be  accounted for. In addition, we asked the experts the reasons various  radionuclides should be considered high risk, the reasons these  radionuclides should not be considered high risk, and on balance,  whether these radionuclides should be considered high risk. Our meeting  agenda and moderator guide also included detailed scenarios designed  to probe issues related to radioactive security and provide clear  parameters within which the experts could make observations. In  particular, we presented the experts with four scenarios of differing  quantities of radioactive material used for particular medical and industrial  purposes and stored under particular circumstances. The four scenarios  presented different types of radioactive materials stored under particular  circumstances. For these scenarios, we asked experts about the primary  vulnerabilities of these materials in terms of access, monitoring and  detection and response, and given the consequences and vulnerabilities,  whether the Part 37 security requirements were sufficient. We based  these scenarios on situations we observed during our prior work on the  security of radioactive material. For each of these scenarios, we asked  experts to assess two key elements of the risk triplet—vulnerability to  being used and consequences if used. For example, we included a  presentation on threat associated with radioactive materials. Additionally,  for each scenario we moderated discussions on scenarios focused on  vulnerabilities of category 1 and category 3 radioactive materials or  scenarios focused on the consequences of category 1 and category 3  RDDs. Furthermore, a GAO methodologist and a National Academies of  Sciences official guided discussions, following the structured moderator  guide to ensure the discussions addressed all topics. The moderators  ensured that experts from all sides had the opportunity to voice their  opinions, but time constraints and the nature of an expert meeting may  have limited some experts from contributing. Because of this structure,  we had no expectation of reaching outright consensus on any specific  topic. After the expert meeting, we conducted a structured and systematic  thematic analysis of the information gathered to better understand the  potential vulnerabilities of radioactive materials to theft and the  consequences of an RDD using various radioactive materials. We also  worked with GAO methodologists to sort the content in the meeting  transcript, identify themes from the sorted information for additional  analysis, and evaluate the credibility of expert statements. GAO internally  reviewed our analysis for completeness and accuracy and it was found to  be sufficient for our purposes. The meeting transcript write-up allowed us  to focus on strengths and weaknesses in current security requirements,  how the federal government evaluates the consequences of an RDD,  what materials should be considered high risk, and whether additional  security measures are necessary for these materials. Experts did not  speak on every topic, did not have the same level of expertise on every  topic, and the meeting format was not designed to quantify experts’  comments. Therefore, we do not report the number of the 18 experts who  agreed or disagreed with various statements. Instead, through our  thematic analysis, we determined that during the expert meeting experts  generally made two types of statements on topics with varying degrees of  agreement or corroboration, which we refer to as either “strong evidence”  or “evidence of varying viewpoints.”

GAO, Government Auditing Standards, 2018 Revision, GAO-18-568G (Washington,  D.C.: July 2018). According to government auditing standards, testimonial evidence  obtained from an individual who is not biased and has direct knowledge about the area is  generally more reliable than testimonial evidence obtained from an individual who is  biased or has indirect or partial knowledge about the area.

Appendix III: Comments from the Nuclear Regulatory Commission

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the individual named above, Ned Woodward (Assistant  Director), Jeffrey Barron (Analyst in Charge), Kevin Bray, Mark Braza,  Kendall Childers, Tara Congdon, Gabrielle Matuzsan, Amanda Miller,  Danny Royer, and Kiki Theodoropoulos made key contributions to this  report.

In the hands of terrorists, radioactive material could be used for a dirty bomb. The Nuclear Regulatory Commission considers the health risks from short-term radiation exposure when determining how to safeguard radioactive material.

But experts told us factors such as deaths during an evacuation and the cost of environmental cleanup should also be considered.

We recommended, among other things, that the NRC consider these additional factors in determining security measures for radioactive material.