NRC also conducts baseline  inspections at nuclear power plants. NRC’s Process for Revising the DBT Was Generally Logical and Well Defined, but Some Changes Were Not Clearly Linked to an Analysis of the Terrorist Threat

The process by which NRC revised the DBT for nuclear power plants was  generally logical and well defined in that trained threat assessment staff  made recommendations for changes based on an analysis of demonstrated  terrorist capabilities. For example, one of the key elements in the  revised DBT, the number of attackers, is based on NRC’s analysis of the  group size of previous terrorist attacks worldwide. The  DOE DBT includes a number of weapons not included in the NRC DBT. Inclusion of such weapons in the NRC DBT for nuclear power plants  would have required plants to take substantial additional security  measures. Changes to the Threat Assessment Staff’s Initial Recommendations Were Not Clearly Linked to an Analysis of the Terrorist Threat

While NRC followed a generally logical and well-defined process to revise  the DBT for nuclear power plants, two aspects of the process raised a  fundamental question—the extent to which the DBT represents the  terrorist threat as indicated by intelligence data compared with the extent  to which it represents the threat that NRC considers reasonable for the  plants to defend against. These two aspects were (1) the process NRC  used to obtain stakeholder feedback on a draft of the DBT and (2) changes  made by the commissioners to the NRC staff’s recommended DBT. NRC specifically sought and  received feedback from the nuclear industry on what is reasonable for a  private security force to defend against and the cost of and time frame for  implementing security measures to defend against specific adversary  characteristics. Nuclear Power Plants Made Substantial Changes to Their Security to Address the Revised DBT, but NRC Inspections Have Uncovered Problems

The four nuclear power plant sites we visited made substantial changes in  response to the revised DBT, including measures to detect, delay, and  respond to the increased number of attackers and to address the increased  vehicle bomb size. These security enhancements were in addition to other  measures licensees implemented—such as stricter requirements for  obtaining physical access to nuclear power plants—in response to a series  of security orders NRC issued after September 11, 2001. Despite the substantial security improvements we observed at the four  sites we visited, it is too early to conclude, either from NRC’s force-on- force or baseline inspections, that all nuclear power plant sites are capable  of defending against the revised DBT for the following two reasons:    First, as of March 30, 2006, NRC had completed force-on-force inspections  at 27 of the 65 sites, and it is not planning to complete force-on-force  inspections at all sites until 2007, in accordance with its 3-year schedule. NRC officials told us that plants have generally performed well during  force-on-force inspections. For example, we recommended that NRC conduct the  inspections more frequently at each site, use laser equipment to better  simulate attackers’ and security officers’ weapons, and require the  inspections to make use of the full terrorist capabilities stated in the DBT. Based on our observations of three force-on- force inspections, other areas where NRC may be able to make further  improvements included the following:    ensuring the proper use of laser equipment;    varying the timing of inspection activities, such as the starting times of the  mock attacks, in order to minimize the artificiality of the inspections;    ensuring the protection of information about the planned scenarios for the  mock attacks so that security officers do not obtain knowledge that would  allow them to perform better than they otherwise would; and   providing complete feedback to licensees on NRC inspectors’ observations  on the results of the force-on-force exercises.
Why GAO Did This Study

The nation's commercial nuclear power plants are potential targets for terrorists seeking to cause the release of radioactive material. The Nuclear Regulatory Commission (NRC), an independent agency headed by five commissioners, regulates and oversees security at the plants. In April 2003, in response to the terrorist attacks of September 11, 2001, NRC revised the design basis threat (DBT), which describes the threat that plants must be prepared to defend against in terms of the number of attackers and their training, weapons, and tactics. NRC also restructured its program for testing security at the plants through force-on-force inspections (mock terrorist attacks). This testimony addresses the following: (1) the process NRC used to develop the April 2003 DBT for nuclear power plants, (2) the actions nuclear power plants have taken to enhance security in response to the revised DBT, and (3) NRC's efforts to strengthen the conduct of its force-on-force inspections. This testimony is based on GAO's report on security at nuclear power plants, issued on March 14, 2006 (GAO-06-388).

What GAO Found

NRC revised the DBT for nuclear power plants using a process that was generally logical and well-defined. Specifically, trained threat assessment staff made recommendations for changes based on an analysis of demonstrated terrorist capabilities. The resulting DBT requires plants to defend against a larger terrorist threat, including a larger number of attackers, a refined and expanded list of weapons, and an increase in the maximum size of a vehicle bomb. Key elements of the revised DBT, such as the number of attackers, generally correspond to the NRC threat assessment staff's original recommendations, but other important elements do not. For example, the NRC staff made changes to some recommendations after obtaining feedback from stakeholders, including the nuclear industry, which objected to certain proposed changes, such as the inclusion of certain weapons. NRC officials said the changes resulted from further analysis of intelligence information. Nevertheless, GAO found that the process used to obtain stakeholder feedback created the appearance that changes were made based on what the industry considered reasonable and feasible to defend against rather than on what an assessment of the terrorist threat called for. Nuclear power plants made substantial security improvements in response to the September 11, 2001, attacks and the revised DBT, including security barriers and detection equipment, new protective strategies, and additional security officers. It is too early, however, to conclude that all sites are capable of defending against the DBT because, as of March 30, 2006, NRC had conducted force-on-force inspections at 27, or less than half, of the 65 nuclear power plant sites. NRC has improved its force-on-force inspections--for example, by conducting inspections more frequently at each site. Nevertheless, in observing three inspections and discussing the program with NRC, GAO noted potential issues in the inspections that warrant NRC's continued attention. For example, a lapse in the protection of information about the planned scenario for a mock attack GAO observed may have given the plant's security officers knowledge that allowed them to perform better than they otherwise would have. A classified version of GAO's report provides additional details about the DBT and security at nuclear power plants.