The Government Accountability Office (GAO) published a report on July 14, 2022, on their investigation to test the NRC and some Agreement States on the process of issuing licenses for possession and use of radioactive materials.
In March 2022, NRC staff was notified that GAO had conducted an undercover investigation focused on whether vulnerabilities identified in the 2007 and 2015 GAO investigations of NRC licensing and license verification were addressed by the regulatory framework and improvements implemented by the NRC and the Agreement States after the prior investigations. This investigation also included an international component to test Customs and Border Protection processes to determine the legitimacy of imports of radioactive materials.
Beginning in 2020, GAO set up five shell companies, including company Websites, in four Agreement States (Virginia, Pennsylvania, Maryland, and New Jersey) using counterfeited licenses made from license images found on the internet. Unlike previous operations that were focused on obtaining a legitimate license from a regulator, GAO did not set up or rent storefronts or other physical locations. GAO was successful in ordering Category 3 sources from two domestic vendors using counterfeit licenses but did not successfully order the third source because the license was identified as fraudulent.
It is important to note that at no point during the investigation was the public’s safety jeopardized as GAO designed the covert operation to ensure control was maintained.
After the NRC learned of the GAO investigation in March 2022, the NRC issued generic communications to remind licensees to ensure, before transferring any radioactive material, that license verification meets the requirements set forth in NRC regulations or other equivalent Agreement State requirements. The NRC provided generic communications to Agreement States for their information and for distribution to their licensees as appropriate.
Commission-
directed rulemaking that includes two specific regulatory changes will address the actions GAO took in this operation
On this page:
Categories of Radioactive Materials
Security requirements depend on potential risks posed by the quantity of a material. The international community has a list of materials that, if not safely managed or securely protected, are thought to pose the greatest threat. Specific quantities of those materials are in one of five categories reflecting the risk the material would pose to someone who removes a source from its shielding and holds it or keeps it nearby. The NRC and the Agreement States have security requirements for all radioactive material, but have additional detailed requirements for the security of Category 1 and 2 materials.
- Category 1: permanent injury likely after a few minutes, could be fatal within an hour
- Category 2: permanent injury possible after minutes to hours, possibly fatal within hours to days
- Category 3: permanent injury possible after several hours, unlikely to be fatal after days to weeks
- Categories 4 and 5: not likely to cause permanent injury or fatality.
What the GAO recommended:
- Immediately require that vendors verify Category 3 licenses with the appropriate regulatory authority.
- Add security features to the licensing process to improve its integrity and make it less vulnerable to altering or forging licenses. These security features could include multifactor authentication or moving away from paper licenses to electronic-based licensing.
Page Last Reviewed/Updated Monday, July 10, 2023