Response to the 2016 GAO Audit and Investigation on NRC and Agreement State Materials Licensing: Questions and Answers
What is a radioactive source?
A radioactive source contains a particular type of radionuclide (such as Americium-241) that is encased in a capsule designed to prevent escape of the material. The capsules used in industrial and medical applications are made of high quality metal and must be built to strict national standards. The NRC and/or an Agreement State approve the design and the use of any radioactive source. The sources will vary in size, but a majority are no larger than an adult's fingernail.
What type of device was GAO licensed for, and what are these devices used for?
GAO received a license for a 16-curie Americium-241/Beryllium (AmBe) source. These well-logging sources emit neutrons and are widely used in oil exploration. The AmBe source would be placed inside a well logging device or "tool." This tool is lowered in the borehole and used to provide data to the surface. It can measure parameters such as resistivity, porosity, formation composition, and density of the subsurface geology. A well logging tool is a sophisticated piece of equipment that contains mini-computers with motherboards and associated circuitry along with multiple sensors and radiation detectors.
How much do these devices cost?
The cost to purchase a 16-curie AmBe source would be at least $15,000. The well logging tool that contains the source would cost from $500,000 to a few million dollars.
How much does it cost to get a radioactive materials license for well logging?
An application for a well logging license from the NRC requires a $4,400 fee. Once licensed, the licensee is required to pay an annual fee to maintain the license. The current annual fee for a well logging license is $14,400. Agreement States also charge fees to review an application for a radioactive material license and maintain it. Agreement State fees vary from state to state but usually are less than those charged by the NRC.
What is an Agreement State?
Congress authorized the NRC to relinquish its authority to a State to regulate certain radioactive materials. Agreement States may regulate source and small quantities of special nuclear materials at academic, medical and industrial facilities within their borders. The NRC and State enter into an "Agreement" giving the State authority to regulate under its own legislation and regulations. Agreement States have to maintain a regulatory program that is adequate to protect public health and safety and compatible with NRC requirements. The compatibility requirements are set by Commission policy. There are currently 37 Agreement States that regulate about 85% of 20,000 radioactive material licenses in the country.
The NRC maintains an oversight responsibility to ensure the Agreement States maintain an adequate and compatible program. The NRC's oversight program is called the Integrated Materials Performance Evaluation Program, or IMPEP. Congress also authorizes the NRC to reassert its authority, if needed.
The NRC is the regulatory authority in non-Agreement States and over nearly all federal agencies that use radioactive materials.
What does it mean, when the terms Category 1, 2, 3, 4 and 5 sources are used?
Categories 1 through 5 are part of a classification system developed by the International Atomic Energy Agency (see Q.7 for more details). This system provides a relative ranking of hazards while taking into account how the source could be used to cause harm. This system ranges such that Category 1 sources have the most harmful effects on a human in a short period of time down to Category 5 sources that are unlikely to cause effects. The NRC security requirements are considerably more stringent for Category 1 and 2 quantities of material.
What is the potential safety and security concern with Category 1, Category 2 and Category 3 sources?
A Category 1 source would likely cause death or permanent injury to someone who remained in contact with it for more than a few minutes.
A Category 2 source could cause death or permanent injury to someone who remained in contact with it (i.e. in a shirt or pant pocket) for a period of hours to days.
For death or permanent injury to happen with a Category 3 source, the individual would have to be in contact with it (i.e. in their pocket) for a period of days to weeks. Death is unlikely from exposure to a Category 3 source. An individual will begin to have physical effects (e.g. ulcerations, reddening of skin, etc.) and likely seek medical help, which would limit further injury and prevent death.
Exposure to a Category 3 source for days to weeks could lead to permanent injury, e.g. loss of fingers, hand, localized tissue or muscle. It's important to point out that the severe health effects mentioned above can be significantly limited, or even prevented. Simple practices such as limiting time near the source (e.g. hours versus days), increasing distance from the material (contact versus a few feet away), and adding shielding (e.g. metal container, bricks) between the individual and the material will minimize exposure.
Why does the NRC only require security for Category 1 and 2 sources; shouldn't all radioactive sources be secured?
All radioactive material is subject to safety and security requirements, not just Categories 1 and 2. For over 50 years, the NRC and Agreement States have had a regulatory framework that ensures the safe and secure control and management of radioactive material. With this framework in place, there is a low possibility of harm to workers and the public, and the benefits from its use will outweigh any risks.
Radioactive material used in medical, academic, and industrial applications is subject to the requirements of 10 CFR Part 20 and 30.Depending on the type of license, the specific requirements of Parts 31, 32, 33, 34, 35, 36 or 39 may also apply. It's common for the regulators and stakeholders to refer to these as safety regulations. However, this doesn't capture the full breadth of these requirements. They address control and management including: security of material in use, storage and transport; qualifications for individuals with control over the material; material accounting; reporting of events; and reporting of loss or theft of materials.
After the events of September 11, national and international regulators agreed that certain radioactive materials in certain quantities warranted additional security measures beyond those already in place. In other words, given the existing threat and consequences from malicious use, we added to the Part 20, Part 30 and application-specific requirements. The NRC and Agreement States required additional security for Category 1 and 2 materials, which is currently included in NRC regulations under Part 37.
The NRC and Agreement State regulatory framework for the safety and security of all radioactive material is consistent with standards and recommendations used globally.
Would the National Source Tracking System (NSTS) have identified the GAO's efforts to collect these devices?
No. The NSTS is intended to capture the manufacture, transfer, receipt, and disposal of radioactive sources at the Category 1 and Category 2 levels. Category 1 and 2 sources are the most harmful. The sources that were the subject of the GAO operation—those contained in well logging devices—are category 3 sources. That means they are below the activity levels of sources that are tracked by the NSTS. Therefore, if a transfer of sources had taken place, the NSTS would not have captured it.
Who is notified if a Region or an Agreement State suspects an illegitimate applicant?
The procedure to handle instances when a license reviewer or inspector suspects an illegitimate applicant requires notification of the Office of Nuclear Material Safety and Safeguards (NMSS) and the Office of Nuclear Security and Incident Response (NSIR). The information may be forwarded to the Federal Bureau of Investigation (FBI) for further review. Suspected cases in Agreement States are forwarded to NMSS and NSIR.
What's the significance if GAO obtained Category 3 material in an amount that could be aggregated to a Category 2 quantity of radioactive material?
The concern with Category 1 or Category 2 quantities is due to their potential to cause serious harm if exposed to them. Because of these concerns, the NRC and Agreement States have additional security measures in place for Category 1 and Category 2 quantities of materials.
Why does the NRC allow paper licenses when they're so easy to alter?
In 2008 after the earlier GAO investigation, the NRC carefully looking at alternatives to paper licenses. We determined it would be impractical and cost prohibitive to transition the 20,000 paper licenses for radioactive material across the NRC and 37 Agreement States within the United States.
However, the NRC and Agreement States apply a graded approach to transfer of material. For Category 1 and 2 quantities of materials, transfers between licensees are not permitted using a paper license. For Category 1 and 2 materials, the licensee sending the material first has to verify with the regulator or with the NRC's License Verification System that the licensee receiving the material is authorized to accept it.
Through these controls, the regulator would quickly identify any license alterations and the transfer would not be approved. Category 1 and 2 materials account for about 11,000 transfers each year. There are approximately 10,000 transfers each year of Category 3 materials.
However, based on this recent GAO sting, the NRC is evaluating its use of paper licenses for Category 3 quantities of radioactive materials.
How do we know there aren't already people collecting sources for a dirty bomb?
The NRC monitors intelligence information to keep abreast of foreign and domestic events and the capabilities of potential adversaries. We use this information, and other sources, to determine the physical protection requirements of our regulations.
NRC staff routinely interacts with the intelligence and law enforcement communities on intelligence and threat matters. For example, NRC maintains contact with the FBI, U.S. Department of Energy, Central Intelligence Agency, Department of Homeland Security, U.S. Customs Service, the Defense Intelligence Agency, Department of Defense, and other agencies concerned with terrorism. NRC staff provides security threat information to licensed nuclear facilities and materials users.
Did the GAO break any break any laws to conduct this investigation?
No. GAO has legal authority to conduct investigations as part of its mission to help improve the performance and ensure the accountability of the Federal government. If an applicant took actions to obtain a license under false pretenses or for malevolent purposes, that would violate the law. In such a case, the current pre-licensing guidance includes steps to notify the NRC and quickly engage the appropriate law-enforcement agency. In addition, the applicant would be subject to State and/or Federal investigation and enforcement.
What will happen to the Agreement State that issued the license to the GAO?
The NRC has an existing oversight process, the Integrated Materials Performance Evaluation Program or IMPEP. We will use IMPEP to evaluate this State's program and ensure that all Agreement States and the NRC Regions are fully implementing the pre-licensing guidance and other licensing process upgrades made to close vulnerabilities after the 2007 GAO investigation. The NRC and the Agreement States will use this experience to assess what in the existing process worked and what didn't.
In order to improve assurance that licenses will only be issued to legitimate applicants, the State completed a self-assessment and root cause analysis. They looked at their implementation of the pre-licensing guidance and the events that led to granting a license to the illegitimate company set up by the GAO. This evaluation will serve as an important starting point for the NRC and Agreement States to evaluate their licensing programs and make enhancements to close any vulnerabilities.
Did the Agreement State that issued the license do a root cause analysis or self-assessment?
Yes, The State that issued the license completed a self-assessment and root cause analysis. The State identified that 1) the license reviewer failed to note inconsistencies during the licensing review process and pre-licensing visit; 2) the staff failed to confirm if the GAO "business" was legitimate; 3) staff involved in issuing the license did not follow all Department procedures; and; 4) program management did not effectively oversee the program. The State has identified other vulnerabilities and has started to take a number of actions to address them. The results of this analysis and other self-assessment will inform NRC's response over the longer term.
Why didn't the changes you made after the 2007 GAO investigation prevent this occurrence?
The NRC and Agreement States put in place a significant number of changes designed to prevent illegitimate companies from obtaining Category 1 and 2 sources. The GAO investigation did not target either a Category 1 or 2 quantity of material because they agree the controls put in place since 2007 are effective.
Rather, this time GAO focused on gathering enough Category 3 materials to aggregate to a Category 2 quantity. This investigation was more sophisticated and required more planning. Additionally, GAO rented storefront/warehouse space to demonstrate their legitimacy to the regulator during pre-licensing visits. Despite this level of effort, GAO was unsuccessful in two of three instances.
However, the GAO investigation did highlight areas where the NRC is considering additional enhancements. That evaluation is ongoing.
What security enhancements have NRC and the Agreement States implemented since the 2007 GAO investigation?
The NRC put in place strict new security requirements via 10 CFR Part 37 to enhance security for Category 1 and 2 materials. Key requirements of the security program for Category 1 and Category 2 materials include:
- Background checks, including fingerprinting to help ensure that individuals with unescorted access are trustworthy and reliable
- Controlling personnel access to areas where radioactive material in quantities of concern are stored and used. Access must be limited to individuals who require it and are deemed trustworthy and reliable, based on a background and criminal history check
- Documented security programs that are designed with defense in depth to detect, assess, and respond to actual or attempted unauthorized access
- Coordination and response planning between the licensee and local law enforcement agencies for its jurisdiction
- Coordination and tracking of radioactive material shipments
- Additional security barriers to prevent theft of portable devices
- In addition to ensuring physical security, the NRC maintains a National Source Tracking System (NSTS) to track and account for, from cradle to grave, all the radioactive sources that warrant the highest level of security and control.
- The NRC also requires verification with the regulator that the receiver is authorized to possess the materials and quantities being transferred. The NRC maintains the License Verification System (LVS) to allow a licensee to conduct this verification with the regulator securely through an on-line system. (The NSTS and Web-based licensing systems were integrated to allow for combined license verification, i.e. a check of both the license validity and a check of the NSTS inventory).
Additionally, the pre-licensing guidance for screening license applicants was revised to provide greater assurance that the radioactive material would be used as intended. It was revised to determine the legitimate use of licensed material and includes the following features:
- "Unknown" applicants are subject to pre-licensing site visits.
- Licensees that request an increase in possession limits (greater than Category 2) are also subject to a site visit.
- All new applicants are subject to screening to verify their legitimacy.
- Personnel that need to access risk-significant licensed material (e.g. greater than Category 2) are subject to a security background check (including fingerprinting).
- Additional guidance is included on procedures for screening and clearer criteria for site visits and further checks
NRC will not authorize receipt of greater than Category 2 quantities of material until confirmation that the licensee/applicant is prepared to implement the security requirements of Part 37.
What is the NRC planning to do in response to the 2016 GAO recommendations?
NRC staff was notified of the GAO investigation in October 2015 and took a number of actions including:
- Took immediate action to ensure no unsafe conditions exist, including working with the impacted Agreement State to ensure that the license obtained by GAO was immediately terminated and relevant manufacturers and distributers were notified.
- Provided refresher training in December 2015 to Agreement State and NRC regional license reviewers and inspectors on pre-licensing guidance and site visits.
- Chartered two working groups to consider:
- Enhancements to the pre-licensing guidance and
- License verification and transfer of Category 3 sources (including alteration of licenses).
A steering committee of NRC and Agreement State managers have reviewed the working groups' reports and recommendations. The steering committee asked both groups to revise their reports and collect additional information to support their recommendations. Based on these recommendations and direction from the Commission, staff will prepare a Commission paper that will address pros and cons of different methods for addressing the GAO recommendations.
Page Last Reviewed/Updated Monday, June 08, 2020