NRC officials said that a new round of security  In September 2012, medical facilities we visited, NRC’s requirements did not consistently  ensure the security of high-risk radiological sources. Challenges Exist in Reducing Security Risks for Different Types of Industrial Radiological Sources

Challenges exist in reducing the security risks faced by licensees using  high-risk industrial radiological sources, even when they follow NRC’s  security controls. Specifically, licensees face challenges, in (1) securing  mobile and stationary sources and (2) protecting against an insider threat. Mobile Industrial Sources

The portability of some industrial radiological sources makes them  susceptible to theft or loss. The most common mobile source,  iridium-192, is contained inside a small device called a radiography  camera. Licensees Face Challenges Protecting Against an Insider Threat

Licensees of mobile and stationary radiological sources face challenges  in determining which of their employees are suitable for trustworthiness  and reliability (T&R) certification, as required by NRC’s security controls.Such certification allows for unescorted access to high-risk radiological  sources. Federal Agencies Are Taking Steps to Improve Security of Radiological Sources but Are Not Always Effectively Collaborating

Federal agencies are taking steps to better secure industrial radiological  sources. NNSA Efforts to Address Security Risks Posed by Industrial Radiological Sources

NNSA has two initiatives under way to address security risks posed by  industrial radiological sources: (1) testing and developing tracking  technology for mobile sources, and (2) upgrading the physical security of  industrial facilities. Our  previous work has identified that when responsibilities cut across more  than one federal agency—as they do for securing industrial radiological  sources—it is important for agencies to work collaboratively. Taking into  account the nation’s long-range fiscal challenges, we noted that the  federal government must identify ways to deliver results more efficiently  and in a way that is consistent with its multiple demands and limited  resources. During this review, we found that the agencies involved in securing  radiological sources—DHS, NNSA, and NRC—meet quarterly, along with  the FBI, for “trilateral” meetings that include, among other things,  discussions of radiological security. However, these meetings did not help  DHS, NNSA, and NRC collaborate and draw on each agency’s expertise  during research, development, and testing of new technology for a mobile  source tracking device. It is unclear whether two cases where employees were granted  unescorted access, even though each had extensive criminal histories— including, in one of the cases, convictions for terroristic threats— represent isolated incidents or a systemic weakness in the T&R process. Without an assessment by NRC, the agency may not have “reasonable  assurance” that the process in place to make access decisions is as  robust as it needs to be to prevent the theft or diversion of high-risk  radiological sources by a determined insider. However, DHS, NRC, and NNSA have  missed the opportunity to leverage resources, including expertise, in  developing a new technology to track radiological sources, which could  aid in the timely recovery of a lost or stolen radiological source and  support the agencies’ common mission. To ensure that the security of radiological sources at industrial facilities is  reasonably assured, we recommend that the Chairman of the Nuclear  Regulatory Commission take the following three actions:
Obtain the views of key stakeholders, such as licensees, during the  development of the Best Practices Guide to ensure that the guide  contains the most relevant and useful information on securing the  highest risk radiological sources. Conduct an assessment of the T&R process—by which licensees  approve employees for unescorted access—to determine if it provides  reasonable assurance against insider threats, including determining why criminal history information concerning  convictions for terroristic threats was not provided to a licensee  during the T&R process to establish if this represents an isolated  case or a systemic weakness in the T&R process; and revising, to the extent permitted by law, the T&R process to  provide specific guidance to licensees on how to review a  employee’s background. To better leverage resources, including expertise, to address  vulnerabilities associated with radiological sources while in transit, we  recommend that the Administrator of NNSA, the Chairman of NRC, and  the Secretary of DHS review their existing collaboration mechanism for  opportunities to enhance collaboration, especially in the development and  implementation of new technologies. NRC generally agreed with our four  recommendations, and NNSA agreed with the one recommendation  directed to it to enhance collaboration with other federal agencies on the  development and implementation of new technologies.
Why GAO Did This Study

In 2012, GAO identified security weaknesses at U.S. medical facilities that use high-risk radiological sources, such as cesium-137. This report addresses potential security risks with such sources in the industrial sector. Radioactive material is typically sealed in a metal capsule called a sealed source. In the hands of a terrorist, this radioactive material could be used to construct a “dirty bomb.” NRC is responsible for licensing and regulating the commercial use of radiological sources. NNSA provides voluntary security upgrades to facilities with such sources. GAO was asked to review the security of sources at industrial facilities. This report examines (1) the challenges in reducing security risks posed by industrial radiological sources and (2) the steps federal agencies are taking to improve security of the sources. GAO reviewed relevant laws, regulations, and guidance; interviewed federal agency and state officials; and visited 33 of about 1,400 U.S. industrial facilities selected based on, among other things, geographic location and type of device using the radiological source.

What GAO Found

GAO found that challenges exist in reducing the security risks faced by licensees using high-risk industrial radiological sources. Specifically, licensees face challenges in (1) securing mobile and stationary sources and (2) protecting against an insider threat. Regarding mobile sources, their portability makes them susceptible to theft or loss, as the size of some of these sources is small enough for them to be easily concealed. The most common mobile source is contained in a device called a radiography camera. GAO identified four incidents from 2006 to 2012 where such cameras that use high-risk sources to test pipeline welds were stolen. These thefts occurred even though the Nuclear Regulatory Commission (NRC) has established increased security controls. Licensees also face challenges in determining which employees are suitable for trustworthiness and reliability (T&R) certification to have unescorted access to high-risk radiological sources. GAO found two cases where employees were granted unescorted access, even though each had extensive criminal histories, and one had been convicted for terroristic threats, which include a range of violent threats. In this case, NRC said that the person was convicted not of a threat against the United States, but of making violent verbal threats against two individuals. It is unclear whether these cases represent isolated incidents or a systemic weakness in the T&R process established by NRC. Without an assessment of the process, NRC may not have reasonable assurance that access decisions made by licensees can prevent threats to high-risk radiological sources, particularly by a determined insider.
Federal agencies responsible for securing radiological sources—including NRC, the National Nuclear Security Administration (NNSA), and the Department of Homeland Security (DHS)—have taken steps to improve the security of industrial radiological sources. For example, NRC is developing a best practices guide that is expected to provide licensees with practical information about how to secure their sources. Also, NNSA is developing new technology that would, if successful, improve tracking of radiological sources while in transit. However, GAO found that although the agencies have been meeting quarterly to discuss, among other things, radiological security, this mechanism did not always help them collaborate and draw on each agency's expertise during research, development, and testing of a new technology for a mobile source tracking device. By not collaborating consistently, the agencies have missed opportunities to leverage resources and expertise in developing this new technology to track radiological sources. This technology could aid in the timely recovery of a lost or stolen radiological source and support the agencies' common mission. As GAO has previously reported, when responsibilities cut across more than one federal agency—as they do for securing industrial radiological sources—it is important for agencies to work collaboratively to deliver results more efficiently and in a way that is consistent with the federal government's multiple demands and limited resources.

What GAO Recommends

GAO recommends, among other things, that NRC assess the T&R process to determine if it provides reasonable assurance against insider threats. In addition, GAO recommends that NNSA, NRC, and DHS review their collaboration mechanism for opportunities to enhance it, especially in the development of new technologies. NRC generally agreed with GAO's recommendations, and NNSA agreed with the one recommendation directed to it. DHS did not comment on the report.