EA-96-120- Robinson 2 (Carolina Power & Light Co.)

May 16, 1996

EA 96-120

Carolina Power & Light Company
ATTN: Mr. C. S. Hinnant, Vice President
H. B. Robinson Steam Electric Plant, Unit 2
3581 West Entrance Road
Hartsville, SC 29550

SUBJECT: NOTICE OF VIOLATION (NRC INSPECTION REPORT NOS. 50-261/96-03)

Dear Mr. Hinnant:

This refers to an inspection conducted during the period March 11 through April 4, 1996, at your H. B. Robinson facility. The inspection included a review of the circumstances surrounding the failure to control safeguards information (SGI) properly. The results of this inspection were sent to you by letter dated April 25, 1996. A closed predecisional enforcement conference was conducted in the Region II office on May 9, 1996, with members of your staff to discuss the apparent violation, the root causes, and your corrective actions to preclude recurrence. A list of conference attendees, NRC slides, and a copy of your presentation materials are enclosed.

Based on the information developed during the inspection and the information that you provided during the conference, the NRC has determined that a violation of NRC requirements occurred. The violation is cited in the enclosed Notice of Violation (Notice), and the circumstances surrounding it are described in detail in the subject inspection report. The violation involved your repeated failure to control SGI adequately in order to prevent access by unauthorized persons. Specifically, the violation relates to instances occurring on February 19-20 and on March 19, 1996, where SGI was left unattended and unsecured for periods of approximately 24 hours and 10 minutes, respectively. The root causes of the violation were your failures to implement effective corrective action for previously identified violations involving SGI and to address findings identified through your own assessment processes appropriately. At the conference, you admitted the violation and further stated that the violation resulted from the failure of your security management to establish and enforce expectations regarding the control of SGI and a lack of sensitivity on the part of the security staff.

The failure to control SGI potentially allowed information about the security program at your Robinson facility to be available to individuals who may not have been authorized access to SGI. Although these events were somewhat mitigated by the fact that the information was left unprotected within the security unit office area, a location which normally is either occupied by security personnel or secured, the unprotected material was located in an area outside the plant protected area, and a reasonable probability existed that unauthorized persons could have accessed it. At the conference, you stated that your investigation did not identify that the unsecured documents had been compromised.

The violation is of particular concern in that you had earlier opportunities to identify programmatic vulnerabilities and prevent the occurrence of the current violation. Specifically, NRC Inspection Report No. 50-261/95-12 issued on May 19, 1995, included a Severity Level IV violation for an April 1995 failure to store SGI in a locked security storage container when unattended which was identified by the NRC. NRC Inspection Report No. 50-261/95-18, issued on June 22, 1995, also included a Severity Level IV violation for four separate failures to handle and protect properly SGI which you identified. The four examples occurred during the period May 1994 through April 1995. In addition, although not cited in the Notice, the NRC noted that in March 1995 and February 1996 your Nuclear Assessment Department (NAD) identified procedural weaknesses in your SGI controls program as well as a low level of sensitivity to the control of SGI on the part of the staff. Although management changes were implemented, your corrective actions for these violations and assessment findings were primarily administrative in nature and did not include changes to safeguards physical control or fully address the performance issues within the security organization to prevent recurrence.

Based on the safety significance, the violation described in the enclosed Notice normally would be categorized as a Severity Level IV violation in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1600. However, as provided by Section IV.B of the Enforcement Policy, the severity level of a Severity Level IV violation may be increased to Severity Level III, if the violation can be considered a repetitive violation. In consideration of the specific circumstances of this case, the NRC has concluded that the current violation is appropriately categorized at a Severity Level III. The bases for this determination were: (1) Seven occurrences of the failure to control safeguards material have been identified within the last two years which resulted in two previously cited Notices of Violation; (2) SGI related issues were identified by NAD during the 1995 and 1996 assessments which were indicative of program weaknesses; (3) The seven occurrences were similar in nature in that they all resulted in SGI being potentially available to unauthorized personnel and increased the probability of compromise; (4) The root causes of the occurrences were the same; and (5) Corrective actions for the two previously cited violations were ineffective to prevent the additional occurrences of unattended SGI in February and March 1996.

In accordance with the Enforcement Policy, a base civil penalty in the amount of $50,000 is considered for a Severity Level III violation. Because your facility has been the subject of escalated enforcement actions within the last two years,¹ the NRC considered whether credit was warranted for Identification and Corrective Action in accordance with the civil penalty assessment process in Section VI.B.2 of the Enforcement Policy. NRC determined that credit was warranted for Identification in that your staff identified both of the examples associated with the current violation. Although your corrective actions for the previous violations were ineffective, at the time of the conference you detailed the following corrective actions for the current violation: (1) additional changes in security management; (2) consolidation and reduction of SGI and document storage containers and locations; (3) implementation of disciplinary action for the individual involved in the March 1996 event; (4) establishment of a SGI work room within the security work area with augmented physical controls; and (5) increased emphasis on internal security department self-assessments and heightened focus on the security program by your NAD. Based on these facts, the NRC determined that the corrective actions for the current violation appear comprehensive and that credit was warranted for the factor of Corrective Action.

Therefore, to encourage prompt identification and correction of violations, I have been authorized, after consultation with the Office of Enforcement, not to propose a civil penalty in this case. However, significant or further repetitive violations in the future could result in a civil penalty.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. In your response, you should document the specific actions taken and any additional actions you plan to prevent recurrence of the violation. In addition, we expect your response to address your corrective actions associated with the previously discussed NAD assessment findings related to the control of SGI. After reviewing your response to this Notice, including your proposed corrective actions and the results of future inspections, the NRC will determine whether further NRC enforcement action is necessary to ensure compliance with NRC regulatory requirements.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response will be placed in the NRC Public Document Room (PDR). To the extent possible, your response should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction.

Sincerely, Original Signed by Luis A. Reyes Stewart D. Ebneter Regional Administrator

Docket No. 50-261
License No. DPR-23

Enclosures:
1. Notice of Violation
2. List of Conference Attendees
3. NRC Slides
4. Licensee Presentation Handout

cc w/encls:
Dale E. Young
Plant Manager
H. B. Robinson Steam Electric Plant
3581 West Entrance Road
Hartsville, SC 29550

J. Cowan, Manager
Operations & Environmental
Support MS OHS7
Carolina Power & Light Company
P. O. Box 1551
Raleigh, NC 27602

R. M. Krich, Manager
Regulatory Affairs
H. B. Robinson Steam Electric Plant
3581 West Entrance Road
Hartsville, SC 29550

Max Batavia, Chief
Bureau of Radiological Health
Dept. of Health and Environmental Control
2600 Bull Street
Columbia, SC 29201

Dayne H. Brown, Director
Division of Radiation Protection
N. C. Department of Environmental
Commerce & Natural Resources
P. O. Box 27687
Raleigh, NC 27611-7687

W. D. Johnson, Vice President
and Senior Counsel
Carolina Power & Light Co.
P. O. Box 1551
Raleigh, NC 27602

Karen E. Long
Assistant Attorney General
State of North Carolina
P. O. Box 629
Raleigh, NC 27602

Robert P. Gruber
Executive Director
Public Staff - NCUC
P. O. Box 29520
Raleigh, NC 27626-0520

Public Service Commission
State of South Carolina
P. O. Box 11649
Columbia, SC 29211

Hartsville Memorial Library
147 W. College Avenue
Hartsville, SC 29550

---

NOTICE OF VIOLATION

Carolina Power and Light Company Docket No. 50-261 H. B. Robinson Steam Electric Plant License No. DPR-23 EA 96-120

During an NRC inspection conducted on March 11 through April 4, 1996, a violation of NRC requirements was identified. In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions," NUREG-1600, the violation is listed below:

10 CFR 73.21(d) requires that safeguards information, while in use, shall be under the control of an authorized individual. 10 CFR 73.21(d)(2) requires that safeguards information be stored in a locked security storage container when unattended.

Technical Specification 6.5.1.1.1.a requires, in part, that procedures be implemented covering the activities recommended in Appendix A of Regulatory Guide 1.33, Revision 2, dated February 1978. Appendix A recommends administrative procedures for security.

Administrative Procedure, AP-028, Revision 12, dated June 16, 1995, Paragraph 5.6.1, states, "Safeguards information shall be protected from unauthorized disclosure. While unattended, safeguards information shall be stored in a locked security storage container."

AP-028, Paragraph 5.12 further states, "Safeguards information shall be under the control of an authorized person while in use in order to limit access to those persons who have a 'need-to-know.' This requirement is satisfied if the material is attended by an authorized person even if the information is in fact not being used."

Contrary to the above, the licensee failed to assure that safeguards information was under the control of an authorized person or stored in a locked security storage container. Specifically, on February 19-20, 1996, safeguards information was left unattended and unsecured for approximately 24 hours in an area outside the protected area, and on March 19, 1996, a safeguards document was left unattended and unsecured for approximately 10 minutes in an area outside the protected area (01013).

This is a Severity Level III Violation (Supplement III)

Pursuant to the provisions of 10 CFR 2.201, Carolina Power and Light Company is hereby required to submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555 with a copy to the Regional Administrator, Region II, and a copy to the NRC Resident Inspector at the H. B. Robinson facility, within 30 days of the date of the letter transmitting this Notice of Violation (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation" and should include for the violation: (1) the reason for the violation, or, if contested, the basis for disputing the violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken to avoid further violations; and (4) the date when full compliance will be achieved. Your response may reference or include previously docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked, or why such other action as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time.

Under the authority of Section 182 of the Act, 42 U.S.C. 2232, this response shall be submitted under oath or affirmation.

Because your response will be placed in the NRC Public Document Room (PDR), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be placed in the PDR without redaction. However, if you find it necessary to include such information, you should clearly indicate the specific information that you desire not to be placed in the PDR, and provide the legal basis to support your request for withholding the information from the public.

Dated at Atlanta, Georgia
this 16th day of May 1996

---

¹ On August 30, 1994, a Severity Level III violation with a $75,000 civil penalty was issued regarding inadequate design reviews and testing for the control room ventilation system (EA 94-119). On November 28, 1994, a Severity Level III violation with a $100,000 civil penalty was issued regarding the failure to control pressurizer cooldown rate (EA 94-205).