NEWS RELEASE
Committee on Energy and Commerce Democrats
Congressman John D. Dingell, Ranking Member

GAO: SECURITY AT NUCLEAR REACTORS
NEEDS STRENGTHENING 

Washington, DC: Representative Edward J. Markey (D-MA), a senior Member of the House Energy and Commerce and Homeland Security Committees, and Representative John Dingell (D-MI), Ranking Member on the House Energy and Commerce Committee, today released a U.S. General Accounting Office (GAO) report entitled: Nuclear Regulatory Commission (NRC): Oversight of Security at Commercial Nuclear Power Plants Needs to be Strengthened. The report found several serious weaknesses in NRC's oversight of security at civilian nuclear reactors.

"It is stunning that the NRC still isn't assuring the safety of the millions of Americans who live near the 104 licensed nuclear reactors two years after the attacks of September 11," said Rep. Markey, who added that "GAO has documented a disturbing pattern of lax NRC oversight and inattention to security at these sensitive facilities that are at the very top of Al Qaeda's list for future attacks."

According to Rep. Dingell, "It is unfortunate that one terrorist attack on American soil wasn't enough to prompt the NRC to pay greater attention to the security risks at some of our country's most vulnerable sites," said Dingell. "The GAO report is another wake up call to the NRC that they need to change their attitude about nuclear security by making much needed improvements immediately." 

The GAO report found the following:

The NRC often minimized the significance of security problems found in annual inspections by classifying them as "non-cited violations." The GAO found that this process "may overstate the level of security at a power plant and reduce the likelihood that needed improvements are made." GAO found that the process of classifying security problems in this way does not require a written response from the reactor licensee and does not require NRC inspectors to ensure that the problem has been corrected. For example, guards at one plant failed to search several individuals after both a walk-through metal detector and a hand-held scanner detected metal objects. The individuals were then allowed unescorted access through the plant's protected area, and this incident was recorded as a "non-cited violation." At another reactor, an NRC inspector found a security guard sleeping on duty for more than half an hour, and this incident was treated as a "non-cited violation" because no terrorist attack had occurred during that time and because neither he nor any guard at the reactor had been found sleeping more than twice during the past year. At a third reactor, a security guard was found to have falsified logs to show that he had checked vital areas of the reactor when in fact he had not done so. NRC issued 72 non-cited security violations from 2000-2001 compared to no cited security violations for the same time period.

Several weaknesses in how the NRC conducts force-on-force exercises of how well a nuclear plant might defend against a real life threat limits their usefulness. During force-on-force exercises designed to test the reactor licensee's ability to defend against a terrorist attack, the NRC has 1) allowed more security guards than are typically present at a reactor to participate in the reactor's defense (an average of 80% more guards were used in 52 of the first 55 exercises conducted), 2) used mock "terrorists" who are not trained in terrorist tactics and were sometimes guards from other reactors, management personnel, or off-duty guards, all of whom could have had a vested interest in ensuring that their colleagues were able to defeat them, 3) used unrealistic weapons such as rubber guns that do not accurately simulate an attack situation, 4) conducted these exercises only once every 8 years, though NRC has announced that it will soon begin conducting them every 3 years, 5) never tested the adequacy of the full range of security requirements the reactors were required to defend against, 6) provided the licensee with up to 12 months advance notice of every force-on-force exercise and 7) failed to issue 60% of all NRC force-on-force exercise reports within the required time of 30-45 days, resulting in delays between the time the exercise was completed and permanent corrective actions were required. Even given the unrealistic and inadequate conditions described, in the force-on-force exercises held before September 11 2001, more than 50% of reactor sites tested failed to defeat the mock "terrorists". NRC suspended its force-on-force exercises after September 11, 2001 and won't formally resume them until fiscal year 2004.

NRC does not require its regional inspectors to conduct follow-up visits to verify that corrective actions have been taken when security violations, including no-cited violations, have occurred. Between 2000 and 2002, only 4 of the 104 nuclear reactors reported security problems that triggered such a follow-up inspection. GAO recommended follow-up visits in these cases.

NRC does not have a routine, centralized manner in which it distributes notices of security problems identified during inspections that could be widespread to other licensees or regional offices of the NRC. NRC does not even maintain copies of inspection reports at its headquarters. The GAO found that adopting "such a mechanism may help plants improve their security.

Rep. Markey concluded, "The fact that NRC Chairman Diaz responded to GAO's report by characterizing these critical security concerns as 'minor issues' suggests that the NRC still doesn't understand that September 11th requires a fundamental change in our thinking about nuclear security. The Commission needs to wake up and start making the type of changes that GAO has called for in this report."

# # #