EA-96-243 - Peach Bottom 2 & 3 (PECO Nuclear)

February 3, 1997

96-243

Mr. D. M. Smith, President
PECO Nuclear
Nuclear Group Headquarters
Correspondence Control Desk
Post Office Box 195
Wayne, Pennsylvania 19087-0195

SUBJECT: NOTICE OF VIOLATION (NRC Inspection Report Nos. 50-352/96-03 and 96-08; 50-353/96-03 and 96-08; 50-277/96-11, and 50-278/96-11)

Dear Mr. Smith:

This letter refers to the two NRC inspections conducted between March 5 and May 6, 1996, and between October 3 and November 27, 1996, at your Limerick Generating Station (LGS) as well as at your Chesterbrook Engineering Information Center facilities. The purpose of the inspections was to review the circumstances associated with your failure to control Safeguards Information (SGI) at your facilities. The findings of the inspections were discussed with members of your staff during exit meetings on May 6 and November 27, 1996. The inspection reports were sent to you on June 13, 1996, and December 19, 1996, respectively. Both letters provided you with an opportunity to attend a predecisional enforcement conference to discuss these findings. In your response letters, dated July 15, 1996, and January 21, 1997, you indicated that a predecisional enforcement conference would not be necessary.

Based on the information developed during the inspections, and information contained in your July 15, 1996, and January 21, 1997, responses to the inspection reports, two violations are being cited involving the failure to control SGI in accordance with the requirements in 10 CFR 73.21. The violations are set forth in the enclosed Notice of Violation.

The first violation of failure to protect SGI occurred at the Limerick station in March 1996 when an individual working on a computer to make revisions to the Limerick Physical Security Plan (a document containing SGI), inadvertently saved the plan on the PECO Local Area Network (LAN) computer hard drive. As a result, access to the Plan was not controlled until a licensed operator discovered the condition on April 11, 1996. The NRC commends the licensed operator who identified this condition and immediately notified your security department. As a result, your computer specialists were promptly contacted to delete the document from the LAN. However, the NRC is concerned that this vulnerability created the opportunity for unauthorized individuals to gain access to the SGI. The NRC recognizes your contention that the name of the file on the LAN did not indicate any relationship to SGI, and such access was unlikely.

The second violation of failure to control SGI was also discovered by your staff and was documented in your investigation report on October 17, 1996. Your report documented separate instances of failure to control SGI information (affecting both Limerick and Peach Bottom) at several locations, including your offices in Chesterbrook, Pennsylvania. In these cases, the SGI primarily consisted of aperture cards (of equipment drawings) which had been stored in an uncontrolled manner at five different locations for periods of up to eight years. While the NRC similarly commends your effort in (1) investigating and identifying the magnitude of this problem, and (2) including your vendors as part of this review, the NRC is concerned that a breakdown in the control of SGI existed for an extended period, because of organizational changes, unclear roles, and a lack of assigned responsibility, as you found during your investigation.

Although your staff determined that the uncontrolled SGI did not constitute the potential to significantly assist an individual in an act of radiological sabotage, these failures to protect SGI, represent a significant regulatory concern. Therefore, the violations have been categorized in the aggregate at Severity Level III in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions," (Enforcement Policy), NUREG-1600.

In accordance with the Enforcement Policy, a base civil penalty in the amount of $50,000 is considered for a Severity Level III violation or problem. You have been the subject of escalated enforcement actions within the last two years. For example, a Severity Level III violation without a civil penalty issued on October 17, 1996, failure to have an appropriate foreign material exclusion program for the suppression pool at Limerick Unit 1 (EA 96-209). Therefore, the NRC considered whether credit was warranted for Identification and Corrective Action in accordance with the civil penalty assessment process in Section VI.B.2 of the Enforcement Policy. Credit is warranted for identification since you identified all of the examples of this violation of 10 CFR 73.21. Credit is also warranted for your corrective action because those actions were considered both prompt and comprehensive once the violation was identified in 1996. Your corrective actions included, but were not limited to (1) promptly deleting the computer file containing the copy of the Physical Security Plan at Limerick; (2) performing a comprehensive review to determine whether other SGI was stored on the LAN; (3) designating a stand-alone computer that is controlled by the LGS Security Section for generation and revisions to safeguards information; (4) retraining the LGS Security Secretary on the procedures for control of SGI; (5) temporary suspension of duplication, filing, and distribution of SGI while your investigation was in progress; (6) recall of SGI from various sites to restrict the number of access locations; (7) establishing a single supervisory point of contact for approving access to SGI; (8) training of individuals involved with SGI; (9) planned revision of the procedure for control of SGI to upgrade expectations for handling SGI.

Therefore, to encourage prompt and comprehensive identification and correction of violations, I have been authorized, after consultation with the Director, Office of Enforcement, not to propose a civil penalty in this case. However, significant violations in the future could result in a civil penalty.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. In your response, you may reference, as appropriate, your prior submittals to the NRC. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, and its enclosure, and your response will be placed in the NRC Public Document Room (PDR).

Sincerely, ORIGINAL SIGNED BY WILLIAM F. KANE FOR Hubert J. Miller Regional Administrator

Docket Nos. 50-352; 50-353; 50-277; 50-278
License Nos. NPF-39; NPF-85; DPR-44; DPR-56

Enclosure: Notice of Violation

cc w/encl:
G. Hunger, Jr., Chairman, Nuclear Review Board and Director - Licensing
W. MacFarland, Vice President - Limerick Generating Station
J. Kantner, Regulatory Engineer - Limerick Generating Station
T. Mitchell, Vice President, Peach Bottom Atomic Power Station
G. Rainey, Senior Vice President, Nuclear Operations
D. Fetters, Vice President, Nuclear Station Support
T. Niessen, Director, Nuclear Quality Assurance
C. Schaefer, External Operations - Delmarva Power & Light Co.
G. Edwards, Plant Manager, Peach Bottom Atomic Power Station
G. Lengyel, Manager, Experience Assessment
J. Durham, Sr., Senior Vice President and General Counsel
P. MacFarland Goelz, Manager, Joint Generation, Atlantic Electric
B. Gorman, Manager, External Affairs
R. McLean, Power Plant Siting, Nuclear Evaluations
J. Vannoy, Acting Secretary of Harford County Council
R. Ochs, Maryland Safe Energy Coalition
J. Walter, Chief Engineer, Public Service Commission of Maryland
L. Jacobson, Peach Bottom Alliance
Secretary, Nuclear Committee of the Board
Commonwealth of Pennsylvania
State of Maryland
TMI - Alert (TMIA)

---

NOTICE OF VIOLATION

PECO Nuclear Docket Nos. 50-352; 50-353; 50-277; 50-278 Limerick & Peach Bottom License Nos. NPF-39; NPF-85; DPR-44; DPR-56 EA 96-243

During two NRC inspections conducted between March 5 and May 6, 1996, and between October 3 and November 27, 1996, violations of NRC requirements were identified. In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions," NUREG-1600, the violations are listed below:

10 CFR 73.21(a) requires, in part, that each licensee who is authorized to operate a nuclear power reactor shall ensure that Safeguards Information is protected against unauthorized disclosure.

10 CFR 73.21(b) requires, in part, the specific types of information, documents and reports that shall be protected are as follows: (i) the composite physical security plan for the nuclear facility or site, and (ii) site specific drawings, diagrams, sketches or maps that substantially represent the final design features of the physical protection system.

10 CFR 73.21(d) requires, in part, that while in use, matters containing Safeguards Information shall be under the control of an authorized individual, and while unattended, Safeguards Information shall be stored in a locked security container.

a. Contrary to the above, from March 19, 1996 to April 11, 1996, an electronic copy of the Limerick Physical Security Plan, which contains Safeguards Information, was located on the PECO Nuclear Local Area Network (LAN), and the document was not under the control of an authorized individual and was available to personnel who were not authorized access to Safeguards Information.

b. Contrary to the above, from approximately 1988 through 1996, approximately 150 items (including aperture cards, film cartridges, and hard copies of drawing change information), which contained design features of the physical protection system that contained Safeguards Information (concerning both the Limerick and Peach Bottom sites), were stored in an uncontrolled manner at various PECO sites, including, but not limited to, its Chesterbrook offices, its Plymouth Meeting Building, and its Philadelphia main office, and at the time, the items were not under the control of an authorized individual and was available to personnel who were not authorized access to Safeguards Information. (01013)

This is a Severity Level III problem (Supplement III).

Pursuant to provisions of 10 CFR 2.201, PECO Nuclear is hereby required to submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555 with a copy to the Regional Administrator, Region I, and a copy to the NRC Resident Inspector at the facility that is the subject of this Notice, within 30 days of the date of the letter transmitting this Notice of Violation (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each violation: (1) the reason for the violation, or, if contested, the basis for disputing the violation, (2) the corrective steps that have been taken and the results achieved, (3) the corrective steps that will be taken to avoid further violations, and (4) the date when full compliance will be achieved. Your response may reference or include previous docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or Demand for Information may be issued as to why the license should not be modified, suspended, or revoked, or why such other actions as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time.

Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.

Because your response will be placed in the NRC Public Document Room (PDR), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

Dated at King of Prussia, Pennsylvania
this 3rd day of February 1997