NRC has relinquished regulatory  authority for licensing and regulating certain radioactive material to 37  states that have entered into an agreement with NRC (agreement  states). NRC and Agreement States Have Taken Several Steps to Better Control Radioactive Materials, but Not Requiring Tracking and Agency License Verification for Category 3 Quantities Leaves Vulnerabilities

NRC and agreement states have taken several steps since 2007 to help  ensure that radioactive materials licenses are granted only to legitimate  organizations and that licensees can only obtain such materials in  quantities allowed by their licenses, but have not taken some measures  for better controlling category 3 quantities of radioactive materials. Further, including all category 3  materials in these systems could help address the risk that paper licenses  issued by NRC and agreement states could be altered or counterfeited or  that a licensee could obtain radioactive materials in quantities greater  than what is allowed by their license. NRC also established a 14-point  checklist to guide prelicensing site visits and developed a list of questions  and activities related to the applicant’s business operations, facility,  radiation safety operations, and personnel qualifications, to scrutinize the  applicant and provide a basis for confidence that the applicant will use the  radioactive material as specified in the license. (On-site security reviews are not  conducted for applicants for category 3-5 licenses.) NRC Developed and Deployed Tracking, Licensing, and Verification Systems to Better Control Category 1 and 2 Quantities of Radioactive Material

To help ensure that licensees can obtain radioactive materials only in  quantities allowed by their licenses, NRC developed and deployed NSTS  and WBL to track category 1 and 2 quantities of radioactive materials and  record specific license information, respectively. Our Testing of NRC and Agreement State Programs Showed Them to Be Effective in Some Cases but Not Others, Allowing Us to Obtain Commitments to Purchase a Dangerous Quantity of Radioactive Materials

Our testing of NRC and agreement state programs showed guidance— including the suspension of the good faith presumption, screening criteria,  and checklists, as well as inspectors’ application of scrutiny during  prelicensing site visits—to be effective in two out of our three cases. In a  third case, we were able to obtain a license for a category 3 quantity of  radioactive materials and secure commitments to purchase a category 2  quantity of radioactive materials by aggregation by altering a paper  license. In order to test the effectiveness of NRC’s revised guidance, screening  criteria, checklists, and the prelicensing site visit, we established three  fictitious companies; leased vacant space in an industrial or office park for  each company (two in agreement states, one in an NRC state); and  submitted an application to the appropriate NRC regional office or  agreement state for a specific radioactive materials license to possess a  high-level category 3 quantity source that was only slightly below the  threshold for a category 2 quantity source. According to NRC officials, while the NRC  prelicensing checklist does not require that a site have implemented all  the requirements that apply to licensees, its purpose, among other things,  is to establish a basis for confidence that radioactive material will be used  as specified on the license being sought, and we made no attempt to  improve or outfit the site to make it appear as if a legitimate business was  operating there. However, notwithstanding NRC’s  guidance to suspend the presumption of good faith, the official from the  regulatory body accepted our assurances without scrutinizing key aspects  of our fictitious business to the extent that the other regulatory bodies  had. GAO Used License to Obtain Vendor Commitments to Sell a Dangerous Quantity of Radioactive Material Considered Attractive for Use in a Dirty Bomb

Once we obtained a license, we were able to exploit the absence of a  requirement to verify the legitimacy of category 3 licenses with the  appropriate regulatory body and obtained commitments to acquire, by  accumulating multiple category 3 sources, a category 2 quantity of  radioactive material. Finally, according to NRC officials,  NRC and agreement state working groups are currently developing and  evaluating enhancements to (1) current prelicensing guidance overall,  and (2) license verification and transfer requirements and prelicensing  guidance for category 3 licenses in particular. NRC also developed revised guidance, screening criteria, and checklists  covering all five IAEA categories of radioactive materials, and now directs  regions and agreement states to conduct prelicensing site visits for all  unknown applicants. Specifically, we recommend that the Nuclear Regulatory Commission  (NRC) take the following three actions:
Take the steps needed to include category 3 sources in the National  Source Tracking System and add agreement state category 3  licenses to the Web-based Licensing System as quickly as reasonably  possible. In its written  comments, reproduced in appendix I, NRC neither explicitly agreed nor  disagreed with our recommendations, but noted that the agency has  formal evaluations underway considering all three recommendations.
Why GAO Did This Study

In 2007, GAO reported weaknesses in NRC's licensing program as GAO investigators, after setting up fictitious companies, were able to obtain an NRC license and then alter it to obtain agreements to purchase devices containing, in aggregate, a dangerous quantity of radioactive materials.
GAO was asked to review and assess the steps NRC and agreement states have taken to strengthen their licensing processes. This report examines (1) the steps NRC and agreement states have taken to ensure that radioactive materials licenses are granted only to legitimate organizations and licensees can obtain materials only in quantities allowed by their licenses; and (2) the results of covert vulnerability testing designed to test the effectiveness of these controls. GAO reviewed relevant guidance documents, regulations, and analyses of orders, and interviewed NRC and state officials. GAO also established three fictitious businesses and applied for a radioactive materials license for each.

What GAO Found

The Nuclear Regulatory Commission (NRC) and the 37 states it permits to grant licenses for radioactive materials—called agreement states—have taken several steps since 2007 to help ensure that licenses are granted only to legitimate organizations and that licensees can only obtain such materials in quantities allowed by their licenses. However, NRC and agreement states have not taken some measures to better control some dangerous quantities of radioactive materials. The International Atomic Energy Agency established a system ranking quantities of certain radioactive materials into five categories based on their potential to harm human health, with, in descending order of danger, categories 1, 2, and 3 all considered dangerous. NRC developed revised guidance, screening criteria, and a checklist, among other things, and now directs NRC regions and agreement states to conduct prelicensing site visits—focusing on questions related to the applicant's business operations, facility, radiation safety operations, and personnel qualifications for all unknown applicants. NRC, however, has not strengthened controls for all categories of radioactive material considered dangerous. Unlike its process for applicants for category 1 and 2 quantities of radioactive materials, for category 3 applicants NRC does not review specific security measures before a license is issued. NRC has also developed and deployed the National Source Tracking System (NSTS), the Web-based Licensing System (WBL), and the License Verification System to better control some materials. However, these systems focus on more dangerous category 1 and 2 quantities but not category 3 quantities. Further, NRC does not specifically require that the validity of category 3 licenses be verified by the seller with NRC or the agreement states—creating risks that licenses could be counterfeited or that licensees could obtain radioactive materials in quantities greater than what is allowed by their licenses.
GAO's covert testing of NRC requirements showed them to be effective in two out of our three cases; in a third case, GAO was able to obtain a license and secure commitments to purchase, by accumulating multiple category 3 quantities of materials, a category 2 quantity of a radioactive material considered attractive for use in a “dirty bomb”—which uses explosives to disperse radioactive material. To test NRC's prelicensing processes, GAO established three fictitious companies, leased vacant space for each company (two in agreement states, one in an NRC state), and submitted an application to the appropriate agreement state or NRC office for a license to possess a category 3 source only slightly below the threshold for category 2. GAO made no attempt to outfit the site to make it appear as if a legitimate business was operating there. In the two cases where GAO was unable to obtain a license, the scrutiny provided by NRC or agreement state (regulatory body) officials during the prelicensing site visit led to the license not being granted. In the third case, the official from the regulatory body accepted GAO's assurances without scrutinizing key aspects of the fictitious business, which led to a license being obtained. NRC is currently taking corrective actions to provide training to NRC and agreement state officials to emphasize greater scrutiny in conducting prelicensing site visits. According to NRC officials, NRC and agreement state working groups are currently developing and evaluating enhancements to (1) prelicensing guidance overall and (2) license verification and transfer requirements for category 3 licenses.

What GAO Recommends

GAO is making three recommendations to NRC, including that NRC (1) take steps to include category 3 quantities of radioactive materials in NSTS and WBL, and (2) require that transferors of category 3 quantities of radioactive materials confirm the validity of licenses with regulators before selling or transferring these materials. GAO provided a draft of this report to NRC for comment. NRC neither agreed nor disagreed with GAO's recommendations, but noted that the agency has formal evaluations underway considering all three recommendations.