EA-99-256 - U. S. Enrichment Corporation

January 3, 2001

EA-99-256; EA-00-047;
EA-00-048

Mr. J. Morris Brown
Vice President - Operations
United States Enrichment Corporation
Two Democracy Center
6903 Rockledge Drive
Bethesda, MD 20817

SUBJECT:

NOTICE OF VIOLATION (NRC OFFICE OF INVESTIGATIONS REPORTS NO. 3-1999-012; 3-1999-033; AND 3-1999-034)

Dear Mr. Brown:

This refers to a security incident on August 28, 1998, when personnel at the U.S. Enrichment Corporation's (Corporation's) Paducah Gaseous Diffusion Plant inadvertently used a computer that was not authorized for processing classified information to develop a classified security contingency plan. While the incident was immediately discovered, it was not reported to Corporation management until on or about October 16, 1998, and the U.S. Nuclear Regulatory Commission (NRC) was not notified until November 4, 1998, although 10 CFR 95.57(b), "Reports," required a security infraction of this type to be immediately reported to the NRC. At least two employees present on August 28, 1998, attributed the reporting delay to a comment made by the then Security Manager, of which one employee took the comment to mean that he would lose his job if the security event was reported. An investigation of the matter was conducted by the Corporation.

The NRC Office of Investigations (OI) also conducted an investigation into the apparent failure to properly report the August 28, 1998, security incident to the NRC. Investigations were also conducted by OI into allegations from one of the employees present on August 28, 1998, and a second employee, that 10 CFR 76.7, "Employee Protection," was allegedly violated as a result of their notification to Corporation management about the August 28, 1998, security infraction. A summary of the OI reports was sent to the Corporation on March 14, 2000, and a predecisional enforcement conference was held at the NRC Region III office on June 26, 2000, to discuss the apparent violations, their significance, their root causes, and your corrective actions. The complainants in this matter attended and participated in the predecisional enforcement conference.

Based on the information developed during the Corporation and OI investigations and from information obtained during and after the predecisional enforcement conference,⁽¹⁾ the NRC has determined that violations of NRC requirements have occurred. The violations are cited in the enclosed Notice of Violation (Notice). Both investigations established that classified information was developed on a computer that was not authorized for that purpose and that the security infraction was not immediately reported to either plant management or the NRC as required. According to the Corporation's representatives at the predecisional enforcement conference, the computer was in the security area of the Paducah facility and it was not likely that the classified information was compromised. The conclusions reached by the Corporation's investigator were: (1) the employees present on August 28, 1998, knew that the security infraction should be reported; and (2) the Security Manager "more likely than not" took action to deter reporting of the security event. Disciplinary action was taken against the Security Manager as a result of that investigation. The information developed during the OI investigation indicated that the then Security Manager's action was a deliberate attempt to cover-up the security event. Information in the OI investigation also indicated that the comment by the Security Manager following the discussion of the classification of the document, a protected activity, caused at least one individual present on August 28, 1998, to believe that his employment would be in jeopardy if the security infraction was reported.

The deliberate failure to report a violation of NRC requirements to management and the NRC is significant because the regulatory process is based on integrity and candid communication. The failure to make reports as required by NRC regulations directly impacts the NRC's ability to consider follow-up actions for potentially serious violations by licensees/certificate holders. Fortunately, in this case the August 28, 1998, security infraction was eventually reported to management by allegation on or about October 16, 1998. The violations associated with the creation of the classified document on August 28, 1998, and the deliberate failure to immediately report that security infraction are collectively categorized in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1600, as a Severity Level III problem (Violation A). The statement made by the Security Manager that resulted in an employee believing that his employment was in jeopardy, is a violation of 10 CFR 76.7, "Employee Protection," and is categorized in accordance with the Enforcement Policy as a Severity Level III violation (Violation B).

In accordance with the Enforcement Policy, a base civil penalty in the amount of $55,000 is considered for a Severity Level III violation or problem. Because Violation A was deliberate and the Paducah Gaseous Diffusion Plant was the subject of escalated enforcement actions within the two year period preceding the August 28, 1998, violations,⁽²⁾ the NRC considered whether credit was warranted for Identification and Corrective Action in accordance with the civil penalty assessment process in Section VI.C.2 of the Enforcement Policy. Credit was warranted for the Identification factor for both Violations A and B as employees brought the issues to the attention of management on or about October 16, 1998, and management immediately investigated the matter. Credit was also warranted for the Corrective Action factor for Violations A and B because disciplinary action was taken against the manager responsible for the violations and plant management immediately notified all employees of its expectations for the immediate reporting of events and open communications. In addition, in a letter dated October 29, 1999, the Corporation described programs that it has implemented or plans to implement to ensure a safety conscious work environment at its NRC-certified facilities.

Therefore, to encourage prompt identification and comprehensive correction of violations, I have been authorized, after consultation with the Director, Office of Enforcement, to not propose a civil penalty for either violation. However, significant violations in the future could result in a civil penalty.

Several other apparent violations were discussed at the predecisional enforcement conference. Those violations included, but were not limited to, alleged employment discrimination when the Security Manager refused to approve out-of-town training for one of the individuals who notified management about the August 28, 1998, incident, and another manager lowering an annual performance rating for another employee responsible for notifying management about the August 28, 1998 event. The available information concerning all of these events was reviewed and the NRC staff determined that insufficient information exists to conclude that violations occurred.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public NRC Library).

		Sincerely,
		/RA/
		J. E. Dyer Regional Administrator

Docket No. 070-7001
Certificate No. GDP-1

Enclosure: Notice of Violation

cc w/encl:
H. Pulley, Paducah General Manager
L. L. Jackson, Paducah Regulatory Affairs Manager
P. D. Musser, Portsmouth General Manager
S. A. Toelle, Director, Nuclear Regulatory
   Assurance, USEC
Paducah Resident Inspector Office
Portsmouth Resident Inspector Office
R. M. DeVault, Regulatory Oversight Manager, DOE
J. C. Hodges, Paducah Site Manager, DOE
J. Volpe, State Liaison Officer

 

---

NOTICE OF VIOLATION

United States Enrichment Corporation Paducah Gaseous Diffusion Facility		Docket No. 070-7001 License No. GDP-1 EA-98-256; EA-00-047

During NRC investigations concluded on October 8 and December 1, 1999, violations of NRC requirements were identified. In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions," NUREG-1600, the violations are listed below:

A.	Violations Associated with the Classified Document
	1.	10 CFR 76.60(i) requires, in part, that the U.S. Enrichment Corporation (Corporation) comply with the provisions of 10 CFR Part 95.
		a.	10 CFR 95.49 requires that classified data or information may not be processed or produced on an ADP (automated data processing) system unless the system and procedures to protect the classified data or information have been approved by the CSA (Cognizant Security Agency). Contrary to the above, on August 28, 1998, classified information was produced on an ADP system (computer) that had not been approved by the CSA for processing classified information. Specifically, a document containing National Security Information was created on an unclassified ADP system which had not been approved to process classified data or information. (01013)
		b.	10 CFR 95.57(b) requires that any infractions, losses, compromises or potential compromises of classified information or classified documents shall be immediately reported to the CSA and the Regional Administrator of the appropriate NRC Regional Office. Contrary to the above, a security infraction occurred when a document containing classified information was created on an unclassified ADP system and the Corporation deliberately did not immediately report the infraction. Specifically, on August 28, 1998, a document containing National Security Information was created on an unclassified ADP system which had not been approved to process classified data or information and the infraction was deliberately not immediately reported to the Regional Administrator of the appropriate NRC Regional Office. The infraction was reported on November 4, 1998, 69 days after the security infraction was identified. (01023)
	2.	Technical Safety Requirement 3.9.1 requires, in part, that written procedures be prepared and implemented to cover the activities described in the SAR (Safety Analysis Report), Section 6.11.4.1. Section 6.11.4.1 of the Safety Analysis Report states, in part, that a procedure is required for any task that is described in, or implements a commitment that is described in the Safety Analysis Report. Section 6.8.2.4 of the Safety Analysis Report, "Problem Reporting," states, in part, that all plant employees have the responsibility to write problem reports on safety, operating, and noncompliance items. Step 6.1.4 of Procedure CP2-BM-CI1031, "Corrective Action Process at PGDP [Paducah Gaseous Diffusion Plant]," Rev. 0, requires that an ATR (assessment and tracking report) be initiated for an off-normal (unexpected, abnormal, unusual) or nonconforming condition. Appendix C of Procedure CP2-BM-Cl1031 lists the conditions adverse to quality (nonconforming conditions) for which ATRs will be generated and includes a security infraction as one example. Contrary to the above, on August 28, 1998, the Corporation deliberately did not initiate an ATR for a nonconforming condition (security infraction). The security infraction occurred when a draft document containing classified information was created on an unclassified computer system and the document was not marked as classified at the time of creation. An ATR was deliberately not initiated at that time and was not initiated until November 4, 1998, 69 days after the security infraction was identified. (01033)
This is a Severity Level III problem (Supplements III and VI).
B.	Violation of Employee Protection Requirement 10 CFR 76.7(a) prohibits, in part, discrimination by the Corporation against an employee for engaging in certain protected activities. Discrimination includes discharge and other actions that relate to compensation, terms, conditions or privileges of employment. The protected activities were established in Section 211 of the Energy Reorganization Act of 1974, as amended, and in general are related to the administration or enforcement of a requirement imposed under the Atomic Energy Act or the Energy Reorganization Act. Contrary to the above, the Corporation discriminated against a security supervisor through the actions of the then site Security Manager for having engaged in protected activities at the Paducah Gaseous Diffusion Plant. Protected activities include any discussion about the classification level to assign to National Security Information at an NRC-regulated facility. Specifically, on August 28, 1998, a document containing National Security Information was created on an unclassified ADP system which had not been approved to process classified data or information. The Security Manager was aware of this infraction and made a statement to the effect of, "if this information leaves the room, I know who was here." That remark by the Security Manager was understood to mean by at least one person, a security supervisor present at the time it was made, as a threat against the security supervisor's employment, thus altering the terms, conditions and privileges of his employment. (01023)

This is a Severity Level III violation (Supplement VII).

Pursuant to the provisions of 10 CFR 76.70, the United States Enrichment Corporation is hereby required to submit a written statement or explanation in reply to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555 with a copy to the Regional Administrator, Region III, and a copy to the NRC Resident Inspector at the Paducah Gaseous Diffusion Facility, within 30 days of the date of the letter transmitting this Notice of Violation (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for each violation: (1) the reason for the violation, or, if contested, the basis for disputing the violation or severity level, (2) the corrective steps that have been taken and the results achieved, (3) the corrective steps that will be taken to avoid further violations, and (4) the date when full compliance will be achieved. Your response may reference or include previous docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked, or why such other action as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time.

If you contest this enforcement action, you should also provide a copy of your response, with the basis for your denial, to the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001.

Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.

Because your response will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS), to the extent possible, it should not include any personal privacy, proprietary, classified, or safeguards information so that it can be made available to the public without redaction. ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public NRC Library). If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.790(b) to support a request for withholding confidential commercial or financial information). If classified or safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21 or 10 CFR Part 95.

In accordance with 10 CFR 19.11, you may be required to post this Notice within two working days.

Dated this 3rd day of January 2001.

 

---

 

1. The complainants submitted information by letter dated July 6, 2000, and the Corporation submitted information by letters dated July 28 and August 31, 2000. Also supplemental interviews were done by OI following the June 26, 2000 predecisional enforcement conference (OI Report No. 3-1999-033(S), dated September 21, 2000).

2. A Severity Level III problem was issued on September 22, 1997, for violations concerning the implementation of the facility security plan occurring as of May 5, 1997 (EA 97-267).

A Severity Level III violation and $55,000 civil penalty were issued on December 8, 1997, for the failure to control classified information outside of the plant controlled area on August 13 and 14, 1997 (EA 97-431).

A Severity Level II violation and $110,000 civil penalty was issued on December 20, 1999, for a violation of 10 CFR 76.7 that occurred on August 10, 1998 (EA-99-110).