NRC Actions to Enhance Security at Commercial Nuclear Power Plants since September 11, 2001

In order to respond to the heightened risk of terrorist attack, NRC has had  extensive interactions with the Department of Homeland Security and the  Homeland Security Council on security at commercial nuclear power  plants. Three Aspects of NRC’s Security Inspection Program Inhibit Effective Oversight

NRC’s security inspection program may not be fully effective because of  weakness in three areas. Violations  were judged to be of low significance and categorized as a non-cited  violation if the problem had not been identified more than twice in the past  year or if the problem had no direct, immediate, adverse consequences at  the time it was identified. In one incident, an inspector observed guards who failed  to physically search several individuals for metal objects after a walk- through detector and a hand-held scanner detected metal objects in  their clothing. The unchecked individuals were then allowed unescorted  access throughout the plant’s protected area. NRC Does Not Systematically Collect, Analyze, and Disseminate Information That May Improve Security at All Plants

NRC does not have a routine, centralized process for collecting, analyzing,  and disseminating security inspections to identify problems that may be  common to other plants or to identify lessons learned in resolving a  security problem that may be helpful to plants in other regions. Although these  exercises have provided learning experiences for the plants and may have  helped improve plant security, the exercises did not fully demonstrate the  plants’ security preparedness. Furthermore, NRC has made only limited  use of some available administrative and technological improvements that  would make force-on-force exercises more realistic and provide a more  useful learning experience. Federal Law Limits the Type of Weapons That Guards Can Use, and State Laws Vary on Guards’ Authority to Deal with Intruders

Commercial nuclear power plants face challenges in securing their plants  against intruders because federal and state laws limit security guards’  ability to defend these plants. As a result, no  nuclear power plants use automatic weapons in their defense. As a result, guards at nuclear  power plants could be at a great disadvantage in terms of firepower, if  attacked. Finally, guards at nuclear power plants do not have nationwide legal  authority and clear guidance on when and how to arrest and/or detain  intruders at the nation’s plants. Lack of follow-up reduces the likelihood that needed  improvements will be made. Such a mechanism may help other plants to improve  their security. Recommendations for Executive Action

To strengthen NRC’s security inspection program, we recommend that the  NRC Commissioners   ensure that NRC’s revised security inspection program and force-on- force exercise program are restored promptly and require that NRC  regional inspectors conduct follow-up visits to verify that corrective  actions have been taken when security violations, including non-cited  violations, have been identified;   ensure that NRC routinely collects, analyzes, and disseminates  information on security problems, solutions, and lessons learned and  shares this information with all NRC regions and licensees; and  make force-on-force exercises a required activity and strengthen them   conducting the exercises more frequently at each plant;  using laser equipment to ensure accurate accounts of shots fired;  requiring the exercises to make use of the full terrorist capabilities  stated in the design basis threat, including the use of an adversary  force that has been trained in terrorist tactics;   continuing the practice, begun in 2000, of prohibiting licensees from  temporarily increasing the number of guards defending the plant and  enhancing plant defenses for force-on-force exercises, or requiring  that any temporary security enhancements be officially incorporated  into the licensees’ security plans; and  enforcing NRC’s requirement that force-on-force exercise reports be  issued within 30 to 45 days after the end of the exercise to ensure  prompt correction of the problems noted. Furthermore, NRC commented that our characterization of non-cited  violations as minimizing the significance of security problems is a serious  misrepresentation. Scope And Methodology

Our objectives were to review (1) the effectiveness of the Nuclear  Regulatory Commission’s (NRC) inspection program to oversee security at  commercial nuclear power plants and (2) legal challenges currently  affecting physical security at the power plants.
Why GAO Did This Study

The September 11, 2001, terrorist attacks intensified the nation's focus on national preparedness and homeland security. Among possible terrorist targets are the nation's nuclear power plants--104 facilities containing radioactive fuel and waste. The Nuclear Regulatory Commission (NRC) oversees plant security through an inspection program designed to verify the plants' compliance with security requirements. As part of that program, NRC conducted annual security inspections of plants and force-on-force exercises to test plant security against a simulated terrorist attack. GAO was asked to review (1) the effectiveness of NRC's security inspection program and (2) legal challenges affecting power plant security. Currently, NRC is reevaluating its inspection program. We did not assess the adequacy of security at the individual plants; rather, our focus was on NRC's oversight and regulation of plant security.

What GAO Found

NRC has taken numerous actions to respond to the heightened risk of terrorist attack, including interacting with the Department of Homeland Security and issuing orders designed to increase security and improve plant defensive barriers. However, three aspects of its security inspection program reduced NRC's effectiveness in overseeing security at commercial nuclear power plants. First, NRC inspectors often used a process that minimized the significance of security problems found in annual inspections by classifying them as "non-cited violations" if the problem had not been identified frequently in the past or if the problem had no direct, immediate, adverse consequences at the time it was identified. Non-cited violations do not require a written response from the licensee and do not require NRC inspectors to verify that the problem has been corrected. For example, guards at one plant failed to physically search several individuals for metal objects after a walk-through detector and a hand-held scanner detected metal objects in their clothing. The unchecked individuals were then allowed unescorted access throughout the plant's protected area. By making extensive use of non-cited violations for serious problems, NRC may overstate the level of security at a power plant and reduce the likelihood that needed improvements are made. Second, NRC does not have a routine, centralized process for collecting, analyzing, and disseminating security inspections to identify problems that may be common to plants or to provide lessons learned in resolving security problems. Such a mechanism may help plants improve their security. Third, although NRC's force-on-force exercises can demonstrate how well a nuclear plant might defend against a real-life threat, several weaknesses in how NRC conducted these exercises limited their usefulness. Weaknesses included using (1) more personnel to defend the plant during these exercises than during a normal day, (2) attacking forces that are not trained in terrorist tactics, and (3) unrealistic weapons (rubber guns) that do not simulate actual gunfire. Furthermore, NRC has made only limited use of some available improvements that would make force-on-force exercises more realistic and provide a more useful learning experience. Even if NRC strengthens its inspection program, commercial nuclear power plants face legal challenges in ensuring plant security. First, federal law generally prohibits guards at these plants from using automatic weapons, although terrorists are likely to have them. As a result, guards at commercial nuclear power plants could be at a disadvantage in firepower, if attacked. Second, state laws vary regarding the permissible use of deadly force and the authority to arrest and detain intruders, and guards are unsure about the extent of their authorities and may hesitate or fail to act if the plant is attacked.