EA-02-085 - U. S. Enrichment Corporation

November 5, 2002

EA-02-085

Mr. J. Morris Brown
Vice President - Operations
United States Enrichment Corporation
Two Democracy Drive
Bethesda, MD 20817

SUBJECT:

NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY -$60,000 (NRC ROUTINE INSPECTION REPORT NO. 07007001/2002-003(DNMS) - PADUCAH GASEOUS DIFFUSION PLANT)

Dear Mr. Brown:

This refers to the routine resident inspection completed on May 1, 2002, at the Paducah Gaseous Diffusion Plant. The purpose of the inspection was to determine whether activities authorized by the certificate were conducted safely and in accordance with NRC requirements. The inspection report, which was transmitted to you in a May 17, 2002, letter, documented two apparent violations involving the failure to control classified information properly. On June 19, 2002, a predecisional enforcement conference was conducted in the Region III office with you and members of your staff to discuss the apparent violations, their significance, their root causes, and your corrective actions.

Following the predecisional enforcement conference, your staff informed the NRC of two additional events where classified material may not have been handled properly. The first event occurred in June 2002, when an assessment and tracking report (ATR) containing classified information was generated on a system that was not approved for classified information, and then was distributed electronically to limited offsite locations. An authorized derivative classifier (ADC) had reviewed the ATR and failed to identify the classified information. The second event involved the use of potentially classified words during a morning telephone conference on plant status that included personnel who had called from offsite locations. During a discussion on August 26, 2002, between Bruce Bartlett of my staff and Steve Cowne of your staff, the United States Enrichment Corporation (USEC) was provided the opportunity to either request a predecisional enforcement conference for the ATR classification event or provide a written response. Mr. Cowne indicated that the USEC would provide a written response. In a September 16, 2002, letter, USEC provided information on the additional events including corrective actions and root cause.

Your staff also conducted a review of the second event and concluded that specific language used during a morning meeting was not classified. While we agree with your conclusion that a violation did not occur, the NRC is concerned that cognizant staff may not be fully aware of classified information that they have a personal responsibility to control.

Based on the information developed during the inspection and the information that you provided during and after the conference, the NRC has determined that two violations of NRC requirements occurred. These violations are cited in the enclosed Notice of Violation (Notice) and the circumstances surrounding them are described in detail in the subject inspection report and in the September 16, 2002, letter. Specifically, the violations involved the failure to ensure that classified information was properly stored when not in use or that the material was under the direct control of an authorized individual, and that classified information was generated and telecommunicated on approved systems.

While no compromise of classified information appears to have occurred, the violations are significant in that the information was not properly secured and could have resulted in individuals without the appropriate security clearance obtaining access to classified information. In addition, these violations are of concern because of the multiple instances of failure to maintain control of classified information, which have been identified over the past several years at the Paducah facility. Therefore, these violations are categorized in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1600 as a Severity Level III problem.

In accordance with the Enforcement Policy, a base civil penalty in the amount of $60,000 is considered for a Severity Level III problem. Because your facility has not been the subject of escalated enforcement actions within the last two years, the NRC considered whether credit was warranted for Corrective Action in accordance with the civil penalty assessment process in Section VI.C.2 of the Enforcement Policy.

In considering whether credit was warranted, the NRC carefully considered all of your corrective actions and the subsequent failure to prevent the ATR classification self-identified event. The NRC concluded that at least three of your corrective actions, established to address loss of control of classified information, should have prevented the classification event. Of particular note was the fact that two of the three corrective actions were completed or implemented prior to the classification event.

Regarding the classification event, one completed corrective action, transmitted via a site Information Bulletin to all plant employees, described the topical classified areas applicable to Paducah and reminded all employees to seek guidance from an ADC when generating potentially classified information. Contrary to the guidance provided, the involved ADC made incorrect assumptions in the initial review. A second completed corrective action required that all cleared monthly employees review a video that described the most commonly used classified points of interest at the Paducah facility. The ADC involved in the classification event, was a cleared monthly employee who had reviewed the video and should have been aware that the reviewed document contained classified information. A third corrective action, which had not been completed when the classification event occurred, involved expansion of the ADC certification class by half a day to allow for more efficient identification of classified information. The certificatee initiated this class on December 11, 2001; however, the involved ADC had not attended the class when the loss of control of classified matter occurred. For this corrective action, the NRC concluded a more timely completion (within two or three months from initiation) could have prevented the classification event. For the reasons described above, the NRC has determined that corrective action credit is not warranted.

Therefore, to emphasize the importance of controlling classified information and of prompt and comprehensive correction of violations, I have been authorized, after consultation with the Director, Office of Enforcement, to issue the enclosed Notice of Violation and Proposed Imposition of Civil Penalty (Notice) in the base amount of $60,000 for the Severity Level III problem. In addition, issuance of this Notice constitutes escalated enforcement action, that may subject you to increased inspection effort.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its enclosures, and your response will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at the Public NRC Library.

		Sincerely,
		/RA/
		J. E. Dyer Regional Administrator

Docket No. 070-07001
Certificate No. GDP-1

Enclosure: Notice of Violation and Proposed Imposition of Civil Penalty

cc w/encl:
R.B. Starkey, Paducah General Manager
S. R. Cowne, Paducah Regulatory Affairs Manager
P. D. Musser, Portsmouth General Manager
S. A. Toelle, Director, Nuclear Regulatory Affairs, USEC
Paducah Resident Inspector Office
Portsmouth Resident Inspector Office
R. M. DeVault, Regulatory Oversight Manager, DOE
W. D. Seaborg, Paducah Site Manager, DOE
Janice H. Jasper, State Liaison Officer

---

NOTICE OF VIOLATION
AND
PROPOSED IMPOSITION OF CIVIL PENALTY

United States Enrichment Corporation Paducah Gaseous Diffusion Plant

Docket No. 070-07001 Certificate No. GDP-1 EA-02-085

During an NRC inspection completed on May 1, 2002, violations of NRC requirements were identified. In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions," NUREG-1600, the NRC proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended (Act), 42 U.S.C. 2282, and 10 CFR 2.205. The particular violations and associated civil penalty are set forth below:

10 CFR 76.60(i) requires, in part, that the certificatee comply with the requirements of 10 CFR Part 95, "Security Facility Approval and Safeguarding of National Security Information and Restricted Data."

	1.	10 CFR 95.25(b) requires, in part, that confidential matter while unattended or not in use must be stored in certain specified containers. 10 CFR 95.27 requires, in part, that while in use, confidential matter must be under the direct control of an authorized individual to preclude physical, audio, and visual access by persons who do not have access authorization. Section 6.3 of the Paducah Security Plan for the Protection of Classified Matter requires, in part, that classified information assigned to individuals be stored, when unattended or not in use in properly equipped security containers. Section 7.0 of the Security Plan for the Protection of Classified Matter requires, in part, that classified matter be kept under the constant surveillance of an authorized person when not in storage. Contrary to the above, from October 5, 2001, through December 17, 2001, the certificatee failed to ensure that Confidential-Restricted Data and Secret-Restricted Data was stored in a specified container while not in use or ensure that the material was under the direct control of an authorized individual. Specifically, classified information was stored in a computerized data base accessible to individuals without proper access authorization and the information was not under the direct control of an authorized individual.
	2.	10 CFR 95.49 requires, in part, that classified data or information may not be processed or produced on an ADP (automated data processing) system unless the system and procedures to protect the classified data or information have been approved by the CSA (Cognizant Security Agency). 10 CFR 95.39(d) requires, in part, that classified information may not be telecommunicated unless the telecommunication system has been approved by the CSA. Contrary to the above, six times between October 5 and December 17, 2001, and in June 2002, the certificatee failed to ensure that classified information was generated and telecommunicated on systems approved by the CSA. Specifically, on five occasions classified information was generated and transmitted and on one occasion classified information was faxed on systems that had not been approved by the CSA.

This is a Severity Level III problem (Supplement III).
Civil Penalty - $60,000

Pursuant to the provisions of 10 CFR 76.70, United States Enrichment Corporation (certificatee) is hereby required to submit a written statement or explanation to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, within 30 days of the date of this Notice of Violation and Proposed Imposition of Civil Penalty (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each alleged violation: (1) admission or denial of the alleged violation, (2) the reasons for the violation if admitted, and if denied, the reasons why, (3) the corrective steps that have been taken and the results achieved, (4) the corrective steps that will be taken to avoid further violations, and (5) the date when full compliance will be achieved. Your response may reference or include previous docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as why the certificate should not be modified, suspended, or revoked or why such other action as may be proper should not be taken. Consideration may be given to extending the response time for good cause shown.

Within the same time as provided for the response required above under 10 CFR 76.70, the certificatee may pay the civil penalty proposed above or the cumulative amount of the civil penalties if more than one civil penalty is proposed, in accordance with NUREG/BR-0254 and by submitting to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, a statement indicating when and by what method payment was made, or may protest imposition of the civil penalty in whole or in part, by a written answer addressed to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission. Should the certificatee fail to answer within 30 days of the date of this Notice of Violation and Proposed Imposition of Civil Penalty, an order imposing the civil penalty will be issued. Should the certificatee elect to file an answer in accordance with 10 CFR 2.205 protesting the civil penalty, in whole or in part, such answer should be clearly marked as an "Answer to a Notice of Violation" and may: (1) deny the violations listed in this Notice, in whole or in part, (2) demonstrate extenuating circumstances, (3) show error in this Notice, or (4) show other reasons why the penalty should not be imposed. In addition to protesting the civil penalty in whole or in part, such answer may request remission or mitigation of the penalty.

In requesting mitigation of the proposed penalty, the factors addressed in Section VI.C.2 of the Enforcement Policy should be addressed. Any written answer in accordance with 10 CFR 2.205 should be set forth separately from the statement or explanation in reply pursuant to 10 CFR 76.70, but may incorporate parts of the 10 CFR 76.70 reply by specific reference (e.g., citing page and paragraph numbers) to avoid repetition. The attention of the certificatee is directed to the other provisions of 10 CFR 2.205, regarding the procedure for imposing a civil penalty.

Upon failure to pay any civil penalty due that subsequently has been determined in accordance with the applicable provisions of 10 CFR 2.205, this matter may be referred to the Attorney General, and the penalty, unless compromised, remitted, or mitigated, may be collected by civil action pursuant to Section 234c of the Act, 42 U.S.C. 2282c.

The response noted above (Reply to Notice of Violation, statement as to payment of civil penalty, and Answer to a Notice of Violation) should be addressed to: Frank Congel, Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, One White Flint North, 11555 Rockville Pike, Rockville, MD 20852-2738, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region III, 801 Warrenville Road, Suite 255, Lisle, IL 60532-4351 and a copy to the NRC Resident Inspector at the facility that is the subject of this Notice.

Because your response will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS), to the extent possible, it should not include any personal privacy, proprietary, classified, or safeguards information so that it can be made available to the public without redaction. ADAMS is accessible from the NRC Web site at the Public NRC Library. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

In accordance with 10 CFR 19.11, you may be required to post this Notice within two working days.

Dated this 5^th day of November 2002.