This is the accessible text file for GAO report number GAO-06-388 
entitled 'Nuclear Power Plants: Efforts Made to Upgrade Security, but 
the Nuclear Regulatory Commission's Design Basis Threat Process Should 
Be Improved' which was released on April 4, 2006. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Chairman, Subcommittee on National Security, Emerging 
Threats, and International Relations, Committee on Government Reform, 
House of Representatives: 

March 2006: 

Nuclear Power Plants: 

Efforts Made to Upgrade Security, but the Nuclear Regulatory 
Commission's Design Basis Threat Process Should Be Improved: 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-388] 

GAO Highlights: 

Highlights of GAO-06-388, a report to the Chairman, Subcommittee on 
National Security, Emerging Threats, and International Relations, 
Committee on Government Reform, House of Representatives: 

Why GAO Did This Study: 

The nation’s commercial nuclear power plants are potential targets for 
terrorists seeking to cause the release of radioactive material. The 
Nuclear Regulatory Commission (NRC), an independent agency headed by 
five commissioners, is responsible for regulating and overseeing 
security at the plants. In April 2003, in response to the terrorist 
attacks of September 11, 2001, NRC revised the design basis threat 
(DBT), which describes the threat that plants must be prepared to 
defend against in terms of the number of attackers and their training, 
weapons, and tactics. NRC has also restructured its program for testing 
security at the plants through force-on-force inspections, which 
consist of mock terrorist attacks. GAO was asked to review (1) the 
process NRC used to revise the DBT for nuclear power plants, (2) the 
actions nuclear power plants have taken to enhance security in response 
to the revised DBT, and (3) NRC’s progress in strengthening the conduct 
of force-on-force inspections at the plants. 

What GAO Found: 

NRC revised the DBT for nuclear power plants using a generally logical 
and well-defined process in which trained threat assessment staff made 
recommendations for changes based on an analysis of demonstrated 
terrorist capabilities. The process resulted in a DBT requiring plants 
to defend against a larger terrorist threat, including a larger number 
of attackers, a refined and expanded list of weapons, and an increase 
in the maximum size of a vehicle bomb. Key elements of the revised DBT, 
such as the number of attackers, generally correspond to the NRC threat 
assessment staff’s original recommendations, but other important 
elements do not. For example, the NRC staff made changes to some 
recommendations after obtaining feedback from stakeholders, including 
the nuclear industry, which objected to certain proposed changes such 
as the inclusion of certain weapons. NRC officials said the changes 
resulted from further analysis of intelligence information. 
Nevertheless, GAO found that the process used to obtain stakeholder 
feedback created the appearance that changes were made based on what 
the industry considered reasonable and feasible to defend against 
rather than on an assessment of the terrorist threat itself. 

Nuclear power plants made substantial security improvements in response 
to the September 11, 2001, attacks and the revised DBT, including 
security barriers and detection equipment, new protective strategies, 
and additional security officers. It is too early, however, to conclude 
that all sites are capable of defending against the DBT because, as of 
November 1, 2005, NRC had conducted force-on-force inspections at about 
one-third of the plants. 

NRC has improved its force-on-force inspections—for example, by 
conducting inspections more frequently at each site. Nevertheless, in 
observing three inspections and discussing the program with NRC, GAO 
noted potential issues in the inspections that warrant NRC’s continued 
attention. For example, a lapse in the protection of information about 
the planned scenario for a mock attack GAO observed may have given the 
plant’s security officers knowledge that allowed them to perform better 
than they otherwise would have. A classified version of this report 
provides additional details about the DBT and security at nuclear power 
plants. 

Barrier Designed to Defend against a Vehicle Bomb: 

[See PDF for image] 

[End of figure] 

What GAO Recommends: 

GAO recommends that NRC improve its process for making changes to the 
DBT and evaluate and implement measures to further strengthen its force-
on-force inspection program. Commenting on the draft report, NRC 
provided clarifications regarding the process NRC used to revise the 
DBT, but it neither agreed nor disagreed with GAO’s recommendations. 

www.gao.gov/cgi-bin/getrpt?GAO-06-388. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Jim Wells at (202) 512-
3841 or wellsj@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

NRC's Process for Revising Its DBT for Nuclear Power Plants Was 
Generally Logical and Well Defined, but Some Changes Were Not Clearly 
Linked to an Analysis of the Terrorist Threat: 

Nuclear Power Plants Made Substantial Changes to Their Security to 
Address the Revised DBT, but NRC Inspections Have Uncovered Problems: 

NRC Has Significantly Improved the Force-on-Force Inspection Program, 
but Challenges Remain: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendixes: 

Appendix I: Scope and Methodology: 

Appendix II: Details of Findings from NRC Reports on Baseline and Force-
on-Force Inspections: 

Appendix III: Comments from the Nuclear Regulatory Commission: 

Appendix IV: GAO Contact and Staff Acknowledgments: 

Table: 

Table 1: Summary of Key Changes to the NRC DBT for Nuclear Power 
Plants: 

Figures: 

Figure 1: Diagram of a Sample Nuclear Power Plant Site: 

Figure 2: Example of a Bullet-Resistant Structure: 

Figure 3: Example of a Vehicle Barrier System: 

Figure 4: Example of an Active Vehicle Barrier System: 

Abbreviations: 

DBT: design basis threat: 

DHS: Department of Homeland Security: 

DOE: Department of Energy: 

FBI: Federal Bureau of Investigation: 

NEI: Nuclear Energy Institute: 

NRC: Nuclear Regulatory Commission: 

Letter March 14, 2006: 

The Honorable Christopher Shays: 
Chairman, Subcommittee on National Security, Emerging Threats, and 
International Relations: 
Committee on Government Reform: 
House of Representatives: 

Dear Mr. Chairman: 

The nation's 103 operating commercial nuclear power plants, located at 
65 sites in 31 states,[Footnote 1] are potential targets for terrorists 
seeking to cause the release of radioactive material. Such a release, 
which may result from a meltdown of a plant's nuclear reactor core or 
damage to the spent nuclear fuel located at the site, could endanger 
public health and safety through exposure to radiation. The Nuclear 
Regulatory Commission (NRC), an independent agency headed by five 
commissioners, licenses commercial nuclear power plants and is 
responsible for regulating and overseeing their safe operation and 
security. According to NRC, there is a general credible threat of a 
terrorist attack to the nation's commercial nuclear power plants, in 
particular by al Qaeda and like-minded Islamic terrorist groups. For 
example, as discussed in The 9/11 Commission Report, nuclear power 
plants were among the targets considered in the original plan for the 
September 11, 2001, attacks.[Footnote 2] However, NRC and intelligence 
agency officials we spoke with said they are not aware of current 
intelligence information indicating specific plans for an attack on a 
nuclear power plant. 

NRC issues and enforces security-related regulations and orders, and 
nuclear power plant licensees implement security measures to meet NRC 
requirements. In particular, to ensure that nuclear power plants are 
secure against a terrorist attack, NRC formulates a design basis threat 
(DBT)--the threat that plants must defend against--and tests plants' 
ability to defend against the DBT.[Footnote 3] The DBT characterizes 
the elements of a potential attack, including the number of attackers, 
their training, and the weapons and tactics they are capable of 
employing. NRC established the first DBT for nuclear power plants in 
the late 1970s. NRC conducts semiannual reviews of the potential 
terrorist threat to determine whether to make changes to the DBT and 
has revised it twice in response to changes in the threat. First, NRC 
expanded the DBT to include a vehicle laden with explosives after two 
incidents in 1993-- the vehicle bombing of the World Trade Center and a 
vehicle intrusion incident at one of the nuclear power plant sites. NRC 
revised the DBT again in April 2003 in response to the terrorist 
attacks of September 11, 2001. Among other changes, this most recent 
DBT increased the number of attackers, refined and expanded the list of 
weapons and equipment that might be used in an attack, and increased 
the maximum size of a vehicle bomb that plants must defend against. 

The DBT does not represent the maximum size and capability of a 
terrorist attack that is possible, but rather NRC's assessment of the 
threat that the nuclear power plants must be prepared to defend against 
"to ensure adequate protection of public health and safety." 
Furthermore, NRC regulations do not require nuclear power plants to 
protect against attacks directed against the sites by an "enemy of the 
United States," whether a foreign government or other person.[Footnote 
4] NRC originally included this provision in its regulations in 1967 
(prior to issuing the first DBT for nuclear power plants). According to 
NRC officials, the provision was intended to address the possibility 
that Cuba might launch an attack on a nuclear power plant in Florida. 
In revising the DBT in April 2003, NRC did not use this provision to 
exempt plants from defending against terrorist groups such as al Qaeda 
but rather stated that a private security force (such as at a nuclear 
power plant) cannot reasonably be expected to defend against all 
threats--for example, airborne attacks. 

Importantly, NRC also works with the Department of Homeland Security 
(DHS), the Federal Aviation Administration, the Federal Bureau of 
Investigation (FBI), and other federal, state, and local authorities to 
coordinate an integrated response to a terrorist threat or attack on a 
nuclear power plant.[Footnote 5] Furthermore, NRC does not directly 
gather intelligence information but rather receives intelligence from 
other agencies that it uses to formulate the DBT for nuclear power 
plants. NRC has access to intelligence information on terrorist 
activities and the domestic terrorist threat, including information 
from secure databases and intelligence reports from intelligence and 
other agencies. 

Before receiving a license to operate a nuclear power plant, owners 
must develop and implement an NRC-approved security plan describing how 
they will defend the site against the threat presented in the DBT. As 
set forth in the security plan, the licensees employ private security 
forces (either hired directly or through a contractor) and provide them 
with the weapons, training, and equipment to defend the site. When NRC 
revised the DBT in 2003, it required licensees to develop new security 
plans describing their strategy for defending the sites against the 
revised DBT and to implement any security enhancements outlined in the 
plans by October 29, 2004. These security enhancements were in addition 
to other measures licensees implemented--such as stricter requirements 
for obtaining physical access to nuclear power plants, minimum training 
requirements for security officers, and limits on the work hours of the 
security force to address the potential for fatigue--in response to a 
series of security orders NRC issued after September 11, 2001. 
According to the Nuclear Energy Institute (NEI), which represents the 
nuclear power industry, the cost of security enhancements made since 
September 11, 2001, for all sites amounts to over $1.2 
billion.[Footnote 6] 

NRC reviews and approves the security plans, conducts regular 
"baseline" inspections to verify compliance with the plans and other 
security requirements, and conducts force-on-force inspections 
involving multiple mock terrorist attacks to ensure sites are capable 
of defending against an attack.[Footnote 7] NRC considers the DBT, the 
security plans, and the results of its inspections and force-on-force 
exercises to contain "safeguards information" and other sensitive 
information, including details about security that could potentially 
aid terrorists plotting to attack a nuclear power plant.[Footnote 8] 
Consequently, NRC does not make this information available to the 
general public, which has made it difficult for the agency to alleviate 
concerns about the level of security at nuclear power plants. The 
concerns center on whether the revised DBT adequately reflects the post-
September 11 threat to nuclear power plants, and whether sites have 
done enough to respond to the threat. 

You asked us to (1) examine the process NRC used to develop the April 
2003 DBT for nuclear power plants, and (2) determine what actions 
nuclear power plants have taken to enhance security in response to the 
revised DBT. In addition, you asked us to review NRC's progress in 
strengthening the conduct of force-on-force inspections. In response, 
we have prepared this unclassified public report, which does not 
include certain details about the DBT and security at nuclear power 
plants that NRC considers to be safeguards information. We have 
prepared a classified version of this report in which we include such 
details. 

To address the first objective, we reviewed the process NRC uses to 
analyze terrorist and criminal activities to assess the threat to 
nuclear power plants. We interviewed NRC officials responsible for 
analyzing information received from the intelligence and law 
enforcement communities and three of the four NRC commissioners serving 
at the time the DBT was revised to determine what factors they took 
into account in deciding on changes to the DBT. We compared the April 
2003 DBT with NRC documents summarizing the threat to nuclear power 
plants and with the Department of Energy (DOE) DBT for its nuclear 
weapons facilities. We also interviewed officials from other federal 
agencies, including DHS and FBI, to obtain their assessments of the 
terrorist threat to nuclear power plants, and we interviewed DOE 
officials regarding the DOE DBT. To address the second objective, we 
visited four nuclear power plant sites (one in each of the four NRC 
regions) to observe the security enhancements that sites made to 
address the revised DBT. We selected the four sites using a number of 
criteria, including size and type of reactor. GAO staff with a 
professional background in security accompanied us on our visits in 
order to provide the expertise needed to fully comprehend the sites' 
security strategies. At each site, we interviewed senior plant 
management, security managers, and security officers. Before visiting 
the four sites, we visited two other nuclear power plants to 
familiarize ourselves with NRC security requirements and the sites' 
security equipment and strategies; at one site, we observed an NRC 
baseline security inspection, and at the other, we observed a force-on- 
force inspection. We did not test the effectiveness of the security 
strategies at the four sites, and we cannot project the results of our 
work to all nuclear power plants. In addition to visiting four sites, 
we reviewed a sample of NRC's baseline and force-on-force inspection 
reports. To review NRC's progress in improving the force-on-force 
inspection program, we observed a total of three force-on-force 
inspections at two sites, reviewed NRC reports on force-on-force 
inspections, and interviewed NRC officials responsible for implementing 
the program. For other views on security at nuclear power plants, we 
interviewed officials from the nuclear industry group NEI and from the 
Project on Government Oversight, an independent nonprofit organization. 
(App. I presents a detailed discussion of our scope and methodology.) 
We conducted our work from November 2004 through January 2006 in 
accordance with generally accepted government auditing standards. 

Results in Brief: 

The process NRC used to revise the DBT for nuclear power plants in 
April 2003 was generally logical and well defined. NRC made the 
revisions as part of a process that it had been using since formulating 
the first DBT in the late 1970s. NRC staff trained in threat assessment 
used reports and secure databases provided by intelligence agencies to 
monitor information on terrorist activities worldwide. To enhance the 
predictability and consistency of its assessments of this information 
and its recommendations to the NRC commissioners for changes to the 
DBT, the NRC threat assessment staff developed and used a comprehensive 
screening tool to analyze intelligence information and evaluate 
particular terrorist capabilities, or "adversary characteristics," for 
inclusion in the DBT. NRC's process also included consultation with 
DOE, which has a DBT for its facilities that process or store 
radiological materials and therefore are also potential targets for 
radiological sabotage, and with stakeholders such as the nuclear power 
industry and state governments. 

Using this process, NRC produced a revised DBT that generally, but not 
always, corresponded to the original recommendations of the threat 
assessment staff. For example, the maximum number of attackers in the 
revised DBT is based in part on the staff's analysis of the size of 
terrorist cells worldwide, as well as NRC's interpretation that 
multiple cells along the lines of the September 11, 2001, attacks would 
not necessarily target a single nuclear power plant. However, for other 
important elements of the DBT, such as the weapons that attackers could 
use against a plant, the final version of the revised DBT does not 
correspond to the staff's original recommendations. We identified two 
principal reasons for these differences: 

* First, the threat assessment staff made changes to its initial 
recommendations after obtaining feedback from stakeholders, including 
the nuclear industry, on a draft of the DBT. A number of the changes 
reflected industry objections to the draft. For example, following 
meetings with industry, the staff decided not to recommend including 
certain weapons in the list of adversary characteristics that nuclear 
power plants should be prepared to defend against. In its comments, the 
industry had pressed for NRC to remove such adversary characteristics 
from the draft DBT. The industry considered these adversary 
characteristics prohibitively expensive to defend against or to be 
representative of an enemy of the United States, which is the 
responsibility of the government, rather than the industry, to defend 
against. When we asked about the changes to the staff's original 
recommendations, NRC officials told us the changes resulted from 
further analysis of the intelligence data and the reasonableness of 
required defensive measures rather than the industry objections. 
Nevertheless, in our view, the process by which NRC used the threat 
assessment staff to obtain stakeholder feedback created the appearance 
that changes were made based on what industry considered reasonable and 
feasible to defend against rather than an assessment of the terrorist 
threat, especially given the high degree of judgment involved in 
assessing threat information. NRC officials said they have altered 
their process in order to better separate the analysis of threat 
information from interaction with stakeholders. 

* Second, in deciding on the revised DBT, the NRC commissioners largely 
supported the staff's recommendations but also made some significant 
changes to those recommendations. These changes reflected the 
commissioners' policy judgments on what is reasonable for a private 
security force to defend against. For example, the commissioners 
decided against including two weapons that the threat assessment staff 
had concluded could plausibly be used against a U.S. nuclear power 
plant. Consideration of issues such as what is reasonable for a private 
security force to defend against can certainly be considered by the 
commissioners in approving changes to the DBT. However, the 
commissioners did not identify explicit criteria for what is and is not 
reasonable for a private security force to defend against, such as the 
cost of defending against particular adversary characteristics. NRC 
officials said detailed criteria on what is reasonable for a private 
security force would reduce the commissioners' discretion in approving 
changes to the DBT. Nevertheless, we believe the absence of reviewable 
criteria reduced the transparency of the commissioners' decisions to 
make changes to the threat assessment staff's recommendations. The 
absence of criteria also potentially reduced the rigor of the decision- 
making process. 

Licensees of nuclear power plants have made substantial changes to 
their security in response to the September 11, 2001, attacks and the 
2003 revisions to the DBT. At the sites we visited, these actions 
included, for example, adding security barriers and detection 
equipment, implementing new protective strategies, enhancing access 
control, and hiring additional security officers. According to NRC, 
other sites implemented similar security enhancements to defend against 
the 2003 DBT. The sites' efforts have been substantial and, in some 
cases, have gone beyond what was required. For example, one site added 
electronic intrusion detection equipment to its outer perimeter, which 
was not required. Despite these considerable efforts, it is too early 
to conclude that all sites are capable of defending against the DBT 
because, as of November 1, 2005, NRC had conducted force-on-force 
inspections at 20 of the 65 sites. According to NRC, sites have 
generally performed well during force-on-force inspections, and the 
results of baseline inspections show that sites have generally complied 
with their security plans. However, a number of sites have experienced 
problems and have not always met security requirements. For example, a 
baseline inspection at one site found that detection equipment 
malfunctioned and had to be fixed. Similarly, we observed a force-on- 
force inspection at another site in which the licensee's performance at 
the time was at best questionable in its ability to defend the site 
against the DBT. According to NRC, it will complete the first cycle of 
triennial force-on-force inspections at all nuclear power plant sites 
on schedule, by 2007. 

NRC has made a number of improvements to its force-on-force inspection 
program, several of which address recommendations we made in our 
September 2003 report on the agency's oversight of security at 
commercial nuclear power plants. For example, NRC is implementing a 
schedule to conduct the inspections more frequently at each site--every 
3 years rather than every 8 years--and has instituted measures to make 
the inspections more realistic, such as using laser equipment to better 
simulate the weapons that attackers and security officers would likely 
employ during an actual attack on a nuclear power plant. These 
improvements are important because, as we noted from our observation of 
three force-on-force inspections and our review of NRC reports on 
others, the inspections have the ability to detect weaknesses in sites' 
protective strategies, which can then be corrected. Nevertheless, in 
observing three inspections and discussing the program with NRC 
officials, we noted issues in the force-on-force program that warrant 
continued NRC attention. For example, a lapse in protection of 
information about the planned scenario for a mock attack that we 
observed may have given the plant's security officers knowledge that 
allowed them to perform better than they otherwise would have. 
According to NRC officials, NRC inspectors have been instructed to be 
vigilant regarding any indications that a site's security force may 
have received advance knowledge of an attack scenario. 

We are recommending that NRC improve its DBT development process in two 
ways. First, we recommend that NRC assign responsibility for obtaining 
feedback from the nuclear industry and other stakeholders on proposed 
changes to the DBT to an office within NRC other than the Threat 
Assessment Section, thereby insulating the staff and mitigating the 
appearance of industry influence on the threat assessment itself. 
Second, we recommend that NRC develop explicit criteria to guide the 
commissioners in their deliberations to approve changes to the DBT. 
These criteria should include setting out the specific factors and how 
they will be weighed in deciding what is unreasonable for a private 
security force to defend against. In addition, we are recommending that 
NRC continue to evaluate and implement measures to further strengthen 
its force-on-force inspection program. In commenting on a draft of this 
report, NRC provided additional clarifying comments pertaining to the 
process NRC used to revise the DBT for nuclear power plants, and we 
revised the report accordingly. NRC's written comments are included in 
appendix III. 

Background: 

NRC is an independent agency established by the Energy Reorganization 
Act of 1974 to regulate the civilian use of nuclear materials. NRC is 
headed by a five-member commission, with one commission member 
designated by the President to serve as chairman and official 
spokesperson. The commission as a whole formulates policies and 
regulations governing nuclear reactor and materials safety and 
security, issues orders to licensees, and adjudicates legal matters 
brought before it. Security for commercial nuclear power plants is 
addressed by NRC's Office of Nuclear Security and Incident Response. 
This office develops policy on security at nuclear facilities and is 
the agency's security interface with DHS, the intelligence and law 
enforcement communities, DOE, and other agencies. Within this office, 
the Threat Assessment Section assesses security threats involving NRC- 
licensed activities and develops recommendations regarding the DBT for 
the commission's consideration. 

The DBT for radiological sabotage applied to nuclear power plants 
identifies the terrorist capabilities (or "adversary characteristics") 
that sites are required to defend against. The adversary 
characteristics generally describe the components of a ground assault 
and include the number of attackers; the size of a vehicle bomb; and 
the weapons, equipment, and tactics that could be used in an attack. 
Other threats in the DBT include a waterborne assault and the threat of 
an insider. The DBT does not include the threat of an airborne attack. 
However, according to NRC officials, NRC regulations do require nuclear 
power plants to implement readily available measures to mitigate 
against the potential consequences of such an attack. In its publicly 
available regulations governing the licensing of nuclear power plants, 
NRC has issued a general description of the DBT--for example, requiring 
sites to defend against an attack by several well-trained and dedicated 
individuals armed with hand-carried weapons and equipment and assisted 
by a knowledgeable insider who participates in a passive or active 
role.[Footnote 9] In April 2003, NRC issued orders to nuclear power 
plant licensees containing a more detailed description of the revised 
DBT, which NRC considers safeguards information. 

NRC requires nuclear power plants to have and implement a security plan 
that describes their strategy for defending against an attack having 
the characteristics of the DBT. Nuclear power plant sites are 
responsible for installing barriers and intrusion detection equipment, 
hiring security officers, and implementing other measures in accordance 
with their security plans. NRC then inspects the sites' compliance with 
the plans and ability to defend against the DBT. After revising the 
DBT, NRC required sites to submit new plans by April 29, 2004, for 
NRC's review and approval and to implement the security described in 
their new plans by October 29, 2004. The plans contain information 
about the sites, including: 

* a description of sites' physical layout, such as barriers and 
buildings, and a description of any environmental features important to 
the effective coordination of response operations; 

* the minimum number of security officers defending the vital areas 
(the areas containing equipment needed to ensure the safe shutdown of 
the reactor and protection of spent fuel pools); and: 

* a description of the protective strategy that sites will enact in 
response to an attack or threat defined in the DBT, such as an external 
land-based assault, a vehicle bomb, a waterborne assault, or an insider 
threat. 

NRC's performance-based means for testing the effectiveness of nuclear 
power plant security programs is through force-on-force inspections. 
These inspections, which consist of 350 hours of on-site inspection 
activity, are intended to demonstrate how well a nuclear power plant 
might defend against a real-life threat. In a force-on-force 
inspection, a professional team of adversaries attempts to reach 
specific "target sets" within a nuclear power plant that would allow 
them to commit radiological sabotage. These target sets represent the 
minimum pieces of equipment or infrastructure an attacker would need to 
destroy or disable to commit radiological sabotage resulting in an 
elevated release of radioactive material to the environment. Force-on- 
force exercises do not directly test the response of outside agencies, 
such as local law enforcement. However, sites simulate actions they 
would take to notify local law enforcement and other outside agencies. 
In addition, according to NRC officials, sites routinely conduct 
liaison activity with local law enforcement and emergency response 
agencies. 

While the adversary characteristics terrorists might use in an actual 
attack are uncertain, the DBT provides parameters for the conduct of 
force-on-force inspections. For example, the mock adversary force is 
constrained to using the specific number of attackers, amount of 
explosives, and weapons and tactics included in the DBT. According to 
NRC officials, the commission recently approved an option to conduct 
force-on-force inspections using adversary characteristics that go 
beyond those in the DBT. This option would be available on a voluntary 
basis to nuclear power plant licensees that are clearly successful in 
defending against the first two mock attacks of the force-on-force 
inspection, which typically includes three mock exercises over 3 days. 

NRC also conducts baseline inspections at nuclear power plants to 
determine that licensees have established measures to deter, detect, 
and protect against the DBT for radiological sabotage. Security 
inspectors in NRC's four regional offices conduct the inspections. 
NRC's policy is to conduct a baseline inspection at each site every 
year, with the complete range of baseline inspection activities 
conducted over a 3-year cycle. One element of a baseline inspection is 
evaluating the site's protective strategy--for example, by conducting 
tabletop drills (simulated attacks using a model of the site) to gain a 
better understanding of the strategy. Inspectors also examine areas 
such as officer training, fitness for duty, positioning and operational 
readiness of multiple physical and technical security components, and 
the controls the licensee has in place to ensure that unauthorized 
personnel do not gain access to the protected area. According to NRC 
officials, agency inspectors spend a total of 136 hours annually at a 
site for a baseline inspection, and the 3-year baseline inspection 
cycle involves more than 400 hours of inspection activity. 

For both force-on-force and baseline inspections, licensees are 
responsible for immediately correcting or compensating for any 
deficiency in which NRC concludes that security is not in accordance 
with the approved security plans or other security orders. According to 
its inspection manual, NRC has 45 days to send a licensee a report on 
the results of an inspection, including any findings and the licensee's 
corrective actions. 

DHS has overall responsibility among federal agencies for assessing the 
vulnerability of the nation's critical infrastructure to terrorist 
attacks and coordinating efforts to enhance security. Nuclear power 
plants represent one sector of the critical infrastructure. Other 
sectors include such things as agriculture, chemical facilities, and 
transportation systems. In 2005, DHS began a series of visits to 
nuclear power plant sites to conduct comprehensive security reviews in 
order to assess the risks and consequences of various types of events 
and to provide better information on the most effective allocation of 
federal resources to improve security at critical infrastructure 
sites.[Footnote 10] DHS conducts the comprehensive reviews with 
relevant agencies such as the FBI and, in the case of nuclear power 
plants, NRC. According to DHS, the comprehensive reviews for nuclear 
power plants focus primarily on the security of the sites "outside the 
fence"--the aspects of security outside the responsibility and control 
of the nuclear power plant licensees. DHS relies on NRC to regulate the 
security of nuclear power plants "inside the fence." DHS officials told 
us that the nuclear power sector is one of the few critical 
infrastructure sectors in which the federal government has the 
authority to regulate the security of sites. According to DHS, as of 
December 2005, the agency had completed 14 comprehensive reviews at 
nuclear power plant sites. 

NRC's Process for Revising Its DBT for Nuclear Power Plants Was 
Generally Logical and Well Defined, but Some Changes Were Not Clearly 
Linked to an Analysis of the Terrorist Threat: 

The process that NRC used to revise its DBT for nuclear power plants 
was generally logical and well defined. In particular, the process 
included an analysis of intelligence and law enforcement information on 
terrorist capabilities and consultation with DOE, which also has a DBT 
for its facilities that are potential targets for terrorists seeking to 
cause radiological sabotage. Using this process, NRC produced a revised 
DBT that usually corresponded to the original recommendations of NRC's 
threat assessment staff. However, certain elements of the revised DBT, 
such as the weapons that attackers could use against a plant, do not 
correspond to the staff's original recommendations for two reasons. 
First, the NRC threat assessment staff charged with reviewing 
intelligence information made changes to its recommendations after 
receiving feedback from stakeholders, including the nuclear industry. 
Given the high degree of judgment involved in assessing threat 
information, the process NRC used to obtain stakeholder feedback 
created the appearance that changes were made based on industry views 
rather than an assessment of the terrorist threat. Second, the NRC 
commissioners made changes to the staff's recommendations on the basis 
of what is reasonable for a private security force to defend against 
but did not identify explicit criteria for such policy judgments. 

NRC Has Been Assessing Threats to Nuclear Power Plants for Many Years: 

NRC made its 2003 revisions to the DBT for nuclear power plants as part 
of a process that the agency has used since first issuing the DBT in 
the late 1970s. In this process, NRC staff trained in threat assessment 
use reports and secure databases provided by the intelligence community 
to monitor information on terrorist activities worldwide. The staff 
analyze this information both to identify specific references to 
nuclear power plants and to determine the capabilities that terrorists 
have acquired and how they might use those capabilities to attack 
nuclear power plants in the United States. The staff normally summarize 
applicable intelligence information and any recommendations for changes 
to the DBT in semiannual reports to the NRC commissioners on the threat 
environment.[Footnote 11] In addition, the threat assessment staff 
promptly report changes in the threat to the commissioners and 
coordinate with the intelligence agencies to help ensure that the staff 
are aware of all pertinent intelligence information. 

In 1999, the NRC staff began developing a set of criteria--the 
adversary characteristics screening process--to decide whether to 
recommend particular adversary characteristics for inclusion in the DBT 
and to enhance the predictability and consistency of their 
recommendations. According to the NRC staff, the adversary 
characteristics screening process, which they used to develop the April 
2003 revised DBT, begins with a thorough review of intelligence reports 
and application of initial screening criteria to evaluate adversary 
characteristics. The staff use the initial screening criteria to 
exclude from further consideration certain adversary characteristics, 
such as those that are already in the DBT or those that would more 
likely be used by a foreign military than by a terrorist group. 

For adversary characteristics that pass the initial round of screening, 
the threat assessment staff apply additional screening factors. 
Examples of such factors include the following: 

* The type of terrorist group that demonstrated the characteristic. For 
example, the staff consider whether an adversary characteristic has 
been demonstrated by transnational or terrorist groups operating in the 
United States, or by terrorist groups that operate only in foreign 
countries. 

* The location and level of social stability where the characteristic 
was demonstrated. For example, the staff consider whether the adversary 
characteristic has been demonstrated in North America and other 
countries with a high level of social stability or in countries with an 
active insurgency or civil war. NRC considers that terrorists planning 
to attack a nuclear power plant in the United States would face greater 
operational security and logistical challenges than terrorists 
operating in countries where there is an internal insurgency. 

* The frequency with which the characteristic has been demonstrated and 
its availability. For example, the staff consider the availability of 
an adversary characteristic on the open or the black market. 

* The type of target the characteristic has been used against, the 
tactical use of the characteristic, and the motive behind its use. For 
example, the staff consider whether the adversary characteristic has 
been used against a target with a level of security similar to that at 
nuclear power plants or against targets with less security, such as the 
October 2002 attack on a Moscow theater by Chechen rebels. 

Depending on the results of this analysis, the threat assessment staff 
may interact with intelligence and other agencies to obtain additional 
information and insights about the adversary characteristics. Finally, 
on the basis of their analysis and interaction with other agencies, the 
staff decide whether to recommend that the commission include the 
adversary characteristics in the DBT for nuclear power plants. NRC's 
Office of Nuclear Security and Incident Response, which includes the 
Threat Assessment Section, reviews and endorses the threat assessment 
staff's analysis and recommendations. 

Since issuing the revised DBT in April 2003, NRC has continued to use 
the adversary characteristics screening process to consider additional 
changes--for example, to consider new intelligence information on 
weapons not included in the revised DBT. In addition, the Energy Policy 
Act of 2005 directed NRC to undertake a rulemaking to revise the DBT 
for nuclear power plants.[Footnote 12] While the detailed description 
of the April 2003 DBT is safeguards information and thus has not been 
made available to the public, the rulemaking, which is under way, 
presents the DBT in less detail so that it can be made available to the 
public and includes a notice and opportunity for public comment. The 
act directed NRC to consider the events of September 11, 2001; the 
potential for an attack on facilities by multiple, coordinated teams of 
a large number of individuals; the potential for suicide attacks; and 
other factors. The April 2003 DBT already includes some (but not all) 
of the adversary characteristics listed in the Energy Policy Act, such 
as attackers who are willing to commit suicide, the potential for a 
waterborne assault, and the use of explosive devices. NRC officials 
told us that, as part of the current rulemaking, they would consider 
all of the factors listed in the Energy Policy Act, including those not 
currently in the DBT. 

NRC Threat Assessment Staff Had to Decide on the Applicability of 
Intelligence Information to Nuclear Power Plants: 

Terrorist attacks have generally occurred outside the United States, 
and intelligence information specific to nuclear power plants is very 
limited. As a result, one of the NRC threat assessment staff's major 
challenges has been to decide how to apply this limited information to 
nuclear power plants in the United States. For example, one of the key 
elements in the revised DBT, the number of attackers, is based on NRC's 
analysis of the group size of previous terrorist attacks worldwide. 
According to NRC threat assessment staff, the number of attackers in 
the revised DBT falls within the range of most known terrorist cells 
worldwide.[Footnote 13] Furthermore, the threat assessment staff told 
us they considered but decided against an even larger number of 
attackers in the draft DBT because a larger cell would face an 
increased potential of detection before it could successfully carry out 
a terrorist attack in the United States. The staff also concluded that 
multiple cells along the lines of the September 11, 2001, attacks would 
not necessarily target a single nuclear power plant. Intelligence and 
law enforcement officials we spoke with did not have information 
contradicting NRC's interpretation regarding the number of attackers 
(or other parts of the NRC DBT) but did point to the uncertainty 
regarding the size of potential attacks and the relative lack of 
intelligence on the terrorist threat to nuclear power plants. 

NRC staff recommendations regarding other adversary characteristics 
also reflected the staff's interpretation of intelligence information. 
For example, the staff considered increasing the vehicle bomb in the 
revised DBT to a range of sizes and ultimately recommended a size that 
was based on an analysis of previous terrorist attacks using vehicle 
bombs.[Footnote 14] One of the largest vehicle bombs ever detonated was 
used in the 1996 bombing of the U.S. military residence in Saudi 
Arabia, and the maximum size of a vehicle bomb used in the United 
States--the 1995 bombing of the federal building in Oklahoma City-- 
consisted of the equivalent of 4,800 pounds of TNT. Additional examples 
of NRC's interpretation of intelligence information and recommendations 
for the revised DBT included the following: 

* The threat assessment staff recommended a maximum weight of equipment 
and explosives per attacker. The staff based this weight on the 
experience and professional knowledge of NRC staff and contractors with 
security backgrounds. In developing these limits, the staff evaluated 
the degree to which attackers would rely on speed of movement rather 
than be encumbered by large amounts of equipment. They also considered 
that a relatively small amount of explosives could cause a large amount 
of damage. 

* The NRC staff recommended including a waterborne assault with a bomb 
size based on available intelligence on waterborne terrorist bombs. In 
addition, according to NRC, watercraft found near nuclear power plants 
would generally be constrained in terms of payload. Furthermore, the 
bomb size recommended by the staff was considered sufficient to 
significantly damage a nuclear power plant's water intake structure. 
The staff considered that a larger bomb would add little to the 
potential damage to the intake structure. 

* The NRC staff supported the inclusion of equipment that is readily 
available through commercial sources but recommended against weapons 
with limited use by terrorists. 

* The staff recommended against including infiltration into a nuclear 
power plant by air because their review of terrorist attacks did not 
demonstrate significant use of such tactics against a fixed site. 

Table 1 summarizes, by adversary characteristic, the key changes to the 
DBT recommended by the NRC staff and the final changes approved by the 
NRC commissioners. 

Table 1: Summary of Key Changes to the NRC DBT for Nuclear Power 
Plants: 

Adversary characteristic: Number of attackers; 
NRC staff's recommended DBT: The staff recommended increasing the 
number of attackers to fall within the range of most known terrorist 
cells worldwide; 
April 2003 revised DBT, as approved by NRC commissioners: The 
commission supported the number of attackers recommended by the NRC 
staff. 

Adversary characteristic: Vehicle bomb; 
NRC staff's recommended DBT: The staff recommended increasing the 
maximum size of a vehicle bomb based on an analysis of previous attacks 
using vehicle bombs. The staff considered a larger vehicle bomb size 
but decided against the larger size after obtaining comments from 
stakeholders, including the nuclear industry; 
April 2003 revised DBT, as approved by NRC commissioners: The 
commission supported the staff recommendation. 

Adversary characteristic: Weapons; 
NRC staff's recommended DBT: The staff refined and expanded the list of 
weapons that could be used in an attack. The staff decided against 
recommending certain weapons after obtaining comments from 
stakeholders, including the nuclear industry; 
April 2003 revised DBT, as approved by NRC commissioners: The 
commission retained most weapons recommended by the staff but removed 
certain weapons the staff had recommended. 

Adversary characteristic: Inside assistance; 
NRC staff's recommended DBT: Active or passive; 
April 2003 revised DBT, as approved by NRC commissioners: Active or 
passive. The commission added a provision that the likelihood of an 
active insider can be reduced by a human reliability program, which 
consists of policies and procedures, such as substance abuse testing, 
designed to help ensure the reliability of personnel. 

Adversary characteristic: Weight of equipment and explosives; 
NRC staff's recommended DBT: Based on the degree to which attackers 
would rely on speed of movement rather than be encumbered by large 
amounts of equipment; 
April 2003 revised DBT, as approved by NRC commissioners: The 
commission reduced the weight recommended by the staff. 

Source: GAO analysis of NRC information. 

[End of table] 

NRC Generally Established Requirements Less Rigorous Than DOE's DBT for 
Radiological Sabotage: 

According to the NRC staff's report on recommended changes to the DBT 
for nuclear power plants, NRC has a long-standing commitment to work 
closely with DOE in an effort to maintain comparable protection for 
comparable facilities. Thus, as part of the process for revising the 
DBT for nuclear power plants, NRC monitored and exchanged information 
with DOE, which also has a DBT for comparable facilities that process 
or store radiological materials and are, therefore, potential targets 
for radiological sabotage.[Footnote 15] However, while certain aspects 
of the two agencies' DBTs for radiological sabotage are similar, NRC 
generally established less rigorous requirements than DOE--for example, 
with regard to the types of equipment that could be used in an attack. 
Additional information regarding key adversary characteristics found in 
both agencies' DBTs includes the following: 

* Number of attackers. Both DOE and NRC based the number of attackers 
on intelligence on the size of terrorist cells. According to DOE 
officials, it is challenging to find intelligence on terrorist 
activities that can be considered equivalent to a ground assault on a 
fixed facility such as a nuclear power plant or DOE site. However, DOE 
officials said they used similar intelligence as NRC to derive the 
number of attackers. 

* Vehicle bomb. DOE and NRC officials provided us with similar analyses 
of intelligence information on previous terrorist attacks using vehicle 
bombs. In particular, DOE and NRC officials told us that most vehicle 
bombs used in terrorist attacks are smaller than the size vehicle bomb 
in NRC's revised DBT. DOE officials also said that site-specific 
characteristics affect the size of vehicle bomb that sites are capable 
of defending against. 

* Weapons. The DOE DBT includes a number of weapons not included in the 
NRC DBT. Inclusion of such weapons in the NRC DBT for nuclear power 
plants would have required plants to take substantial additional 
security measures. Furthermore, DOE included other capabilities in its 
DBT that are not included in the NRC DBT. As discussed below, NRC staff 
considered some of the weapons in DOE's DBT for inclusion in the DBT 
for nuclear power plants but removed them while drafting the DBT. 

DOE established an even more stringent DBT for its sites that store 
nuclear weapons (or material that could be used in a nuclear weapon). 
The security objective for these sites is to prevent the theft or 
detonation of a nuclear weapon. DOE decided on a more stringent DBT to 
protect nuclear weapons facilities than sites with the potential for 
radiological sabotage in accordance with its graded approach, which 
provides for a higher level of protection to sites with greater 
potential consequences to public health and safety in the event of a 
terrorist attack. According to DOE officials, the consequences of theft 
or detonation of a nuclear weapon would be "orders of magnitude" 
greater than radiological sabotage at a DOE site or nuclear power 
plant. 

Consistent with DOE's graded approach, NRC officials told us they do 
not consider comparisons between the DOE DBT for nuclear weapons 
facilities and the NRC DBT for nuclear power plants valid. NRC 
considers that the potential consequences of the theft of material that 
could be used in a nuclear weapon could be much greater than 
radiological sabotage at a nuclear power plant. Furthermore, according 
to NRC officials, terrorists seeking to steal or detonate a nuclear 
weapon would require greater capabilities to accomplish their 
objectives than terrorists seeking to cause radiological sabotage. For 
example, theft of a nuclear weapon (or material that could be used in a 
weapon) would require terrorists to defeat a site's security systems 
when entering and leaving a site. In contrast, attackers willing to 
commit suicide in the process of causing the release of radiological 
material from a nuclear power plant would have to overcome security to 
enter a site and reach a target set but would not have to leave the 
site. Like DOE, NRC uses a graded approach to security, and, therefore, 
the NRC DBT for NRC-licensed facilities that store or process material 
that could be used in a nuclear weapon is more stringent than the NRC 
DBT for nuclear power plants. 

NRC's Process for Obtaining Feedback on the Draft DBT Created the 
Appearance of Industry Influence on the Threat Assessment Staff's 
Analysis of Intelligence Information: 

NRC staff sent a draft DBT to stakeholders in January 2003, held a 
series of meetings with them to obtain their comments, and received 
written comments. In addition to nuclear power plant licensees and NEI, 
which represents the nuclear industry, these stakeholders included 
other federal agencies and government authorities in affected states. 
NRC specifically sought and received feedback from the nuclear industry 
on what is reasonable for a private security force to defend against 
and the cost of and time frame for implementing security measures to 
defend against specific adversary characteristics.[Footnote 16] During 
the same period that the threat assessment staff was receiving industry 
and other stakeholder feedback, they continued to analyze intelligence 
information and modify the draft DBT. In April 2003, NRC staff 
submitted their final draft DBT to the commissioners for their review 
and approval, together with a summary of stakeholder comments. 

In its written comments on the January 2003 draft DBT, NEI objected to 
the size of the vehicle bomb, the inclusion of certain weapons, and the 
inclusion of an active violent insider. The NRC staff's draft DBT 
submitted to the commissioners reflected some (but not all) of NEI's 
objections. The reasons for NEI's objections to key adversary 
characteristics and changes to the NRC threat assessment staff's 
recommendations included the following: 

* Vehicle bomb. NEI objected to the vehicle bomb in the draft DBT 
because of its assessment of (1) the low probability of a vehicle bomb 
of the size proposed by NRC, (2) the likelihood that federal 
authorities or local law enforcement would detect a large vehicle bomb, 
and (3) the inability of some sites to protect against the size of the 
vehicle bomb proposed by NRC because of insufficient land for 
installation of vehicle barrier systems at a necessary distance. 
Instead, NEI agreed that it would be reasonable to protect against a 
smaller vehicle bomb. In its recommendations to the commissioners, the 
NRC staff subsequently reduced the size of the vehicle bomb to the 
amount proposed by NEI. After review, the staff's reason for agreement 
with NEI was that vehicle bombs as large as that included in the draft 
provided to stakeholders had rarely been used in previous terrorist 
attacks and would not be reasonable or practical to include in the DBT. 

* Weapons. NEI argued against the inclusion of a number of weapons. For 
example, NEI wrote that (1) one particular weapon recommended by the 
NRC staff would render the ballistic shielding used at nuclear power 
plants obsolete, and (2) another proposed weapon would initially cost 
$1 million to $7 million per site to defend against, with annual 
recurring costs of up to $2 million per site. Furthermore, NEI argued 
that these weapons (as well as the vehicle bomb size initially proposed 
by the NRC staff) would be indicative of an enemy of the United States, 
which sites are not required to protect against under NRC regulations. 
In the final draft submitted to the NRC commissioners, the NRC staff 
removed a number of weapons NEI had objected to. The staff reasoned 
that the weapons had rarely been used in armed assaults, or had been 
used infrequently in terrorist assaults despite their wide availability 
and use by violent criminals in the United States.[Footnote 17] NRC 
staff did not remove one particular weapon NEI had objected to, which, 
according to NRC's analysis, has been a staple in the terrorist arsenal 
since the 1970s and has been used extensively worldwide. (As discussed 
below, the NRC commissioners later voted to remove this particular 
weapon.) 

* Inside assistance. NEI wrote that the nuclear power industry had 
taken a number of steps to reduce the likelihood of an active violent 
insider--for example, it tightened the process for granting employees 
unescorted access to nuclear power plants. Furthermore, NEI wrote that 
the industry had been unable to identify cost-effective solutions to 
defend against an active violent insider, and that costs would range 
from $2 million to $8 million per site for equipment and $5 million per 
site per year for additional personnel. Despite these objections, the 
NRC staff recommended the inclusion of an active violent insider in the 
final draft of the DBT. (The NRC commissioners later allowed nuclear 
power plants to reduce the likelihood of an active violent insider 
through a human reliability program.) 

The chief of NRC's threat assessment staff told us that NRC did not 
make changes to the draft DBT based solely on industry views. Rather, 
according to NRC officials, the changes were made based on multiple 
internal analyses and discussions among the threat assessment staff and 
higher levels of review within NRC and its Office of Nuclear Security 
and Incident Response, which includes the Threat Assessment Section. 
Nevertheless, in our view, the process NRC used to obtain feedback from 
stakeholders, including the nuclear industry, created the opportunity 
for, and appearance of, industry influence on the threat assessment 
regarding the characteristics of an attack. 

When we raised this issue with NRC officials, they told us that under 
normal circumstances the threat assessment process is initially 
undertaken utilizing intelligence and law enforcement information, with 
other stakeholders subsequently having an opportunity to provide 
feedback--for example, regarding the cost of implementing security 
measures in response to proposed changes to the DBT. Furthermore, NRC 
threat assessment staff and other intelligence agency officials told us 
they support the separation of intelligence analysis from other 
responsibilities, such as obtaining stakeholder feedback on changes to 
the DBT, in order to insulate analysis of intelligence from other 
considerations. However, according to NRC, the agency made a deliberate 
decision as part of the process for revising the DBT in 2003 to have 
the threat assessment staff analyze intelligence information and obtain 
stakeholder feedback simultaneously, rather than sequentially, in order 
to accelerate the process in response to the increase in the terrorist 
threat. NRC officials said that in considering future changes to the 
DBT, NRC plans to ensure the initial separation of intelligence 
analysis from interaction with stakeholders. 

The NRC Commission Made Key Policy Judgments about Changes to the DBT 
without Criteria on Threats That a Private Security Force Could 
Reasonably Defend Against: 

The NRC staff provided the commissioners with a number of documents to 
consider in making the final decision on changes to the DBT. These 
included, but were not limited to, two assessments in the fall of 2002 
on the terrorist threat to nuclear power plants (one specifically on 
the potential use of vehicle bombs) and a final paper in April 2003 
with the staff recommendations for revisions to the DBT. The April 2003 
document also included a summary of comments on the draft DBT received 
from the nuclear industry and other federal and state agencies; a 
summary of NEI's estimates of the cost of and time frame for 
implementing security measures to address specific changes to the DBT; 
and an updated assessment of the terrorist threat to nuclear power 
plants. The NRC commissioners told us they also had direct contacts 
with intelligence agencies that provided them with information on the 
terrorist threat. 

The commissioners made the final decision on changes to the DBT by 
majority vote.[Footnote 18] While the commission largely supported the 
NRC staff's recommendations for changes to the DBT, it also made some 
significant changes that reflected policy judgments. Specifically, the 
commissioners considered whether any of the recommended changes to the 
DBT constituted characteristics representative of an enemy of the 
United States, which sites are not required to protect against under 
NRC regulations. In approving the revised DBT, the commission stated 
that nuclear power plants' civilian security forces cannot reasonably 
be expected to defend against all threats, and that defense against 
certain threats (such as an airborne attack) is the primary 
responsibility of the federal government, in coordination with state 
and local law enforcement officials. In connection with this position, 
the commission directed NRC's Office of General Counsel to prepare a 
paper for commission approval articulating the factors to be considered 
in determining whether particular characteristics of an attack 
constitute an enemy of the United States. (Officials from NRC's Office 
of General Counsel told us they prepared a document with an analysis of 
this issue for the commission, but that the document was not a decision 
paper for approval by the commissioners.) 

We recognize that consideration of issues such as what is reasonable 
for a private security force to defend against is an appropriate role 
of the commission in approving changes to the DBT. However, in 
approving the revised DBT, the commission did not identify explicit 
criteria for determining whether specific adversary characteristics 
constitute an enemy of the United States or criteria for what is 
reasonable for a private security force to defend against. For example, 
the commission did not define whether the criteria include the cost for 
nuclear power plants to defend against an adversary characteristic or 
the efforts of local, state, and federal agencies to address particular 
threats. The lack of such criteria can reduce the transparency of 
commission decisions to make changes to the threat assessment staff's 
recommendations. NRC officials said detailed criteria on what is 
reasonable for a private guard force would reduce the commissioners' 
discretion in approving changes to the DBT. Furthermore, in NRC's view, 
the basis for the commission's policy decisions and direction to the 
NRC staff regarding the DBT are sufficiently articulated in the 
commission's voting record, in which individual commissioners provided 
the rationale for their votes, and in the related staff requirements 
memorandum, which documented the commission's decisions. 

As indicated in table 1, the significant changes the commission made to 
the NRC staff's recommendations included removal of certain weapons, a 
decrease in the maximum amount of weight carried by the attackers, and 
mitigation of an active insider through a human reliability program. In 
other cases, such as the size of the vehicle bomb, the commission 
supported the recommendations of the NRC staff. Based on our review of 
the commissioners' voting records, the commission's decisions on key 
aspects of the DBT included the following: 

* Vehicle bomb. A majority of commissioners voted to increase the 
maximum vehicle bomb to the size recommended by the NRC staff. However, 
one commissioner supported a larger vehicle bomb that the NRC staff had 
included in a previous draft of the DBT. The commissioner recognized 
that some sites would not have sufficient property to install vehicle 
barrier systems far enough from the plants to protect against the 
larger vehicle bomb and suggested NRC could provide such sites with an 
exemption and require them to protect against a smaller vehicle bomb. 

* Weapons. The commission decided to remove two weapons the NRC staff 
had recommended for inclusion in the revised DBT. As part of this 
decision, the commission directed the staff to conduct an in-depth 
analysis of the additional defensive capabilities, changes to sites' 
protective strategies, and costs associated with protecting against one 
of the weapons. Removal of weapons from the revised DBT was significant 
because of the strength of the NRC staff's intelligence analysis 
supporting their inclusion. For example, in the April 2003 report to 
the commissioners, the NRC staff reported that while one such weapon 
had not been used in the United States, it had been found in weapons 
caches in the United States. Similarly, the staff noted the use of the 
other weapon in captured terrorist training videos and its ready 
availability. The document summarizing the commission's changes to the 
proposed DBT did not provide a reason for excluding these weapons. 
However, in written comments on their votes, one commissioner 
identified these weapons as representative of an enemy of the United 
States; another commissioner agreed that threat data showed an 
increased possibility of the use of these weapons but stated that NRC 
staff needed to assess whether it would be reasonable for a private 
security force to defend against such weapons. One of the commissioners 
supported inclusion of these weapons in the DBT, as well as other 
weapons the staff had not recommended, but nevertheless told us there 
was more agreement than disagreement among the commissioners about what 
weapons should be included. The same commissioner told us he supported 
inclusion of one of the weapons because he considered the means for 
defending against it to be affordable. 

* Weight of equipment and explosives. In voting to decrease the maximum 
weight of equipment, weapons, and explosives (such as grenades) per 
attacker in the final DBT, three of the commissioners indicated they 
supported decreasing the weight that an attacker could be expected to 
carry. In their written comments, the three commissioners indicated 
that the staff's recommendation regarding carry weight would require 
further study--for example, to determine whether the greater amount of 
weight could reduce the capability of the attack force by reducing 
individual attackers' mobility. 

* Inside assistance. The commission added language to the DBT stating 
that a human reliability program for monitoring employees at the sites 
could reduce the likelihood of an active insider. To qualify, the 
sites' human reliability program would have to include background 
checks, substance abuse testing, psychological evaluations, annual 
supervisory review, and periodic background reinvestigations. The 
commissioners told us they made this decision based, in part, on the 
long-standing assumption by NRC that a human reliability program 
reduces the likelihood of an active insider. The commissioners also 
told us that other factors, such as increased awareness about the 
potential for an attack in the communities where nuclear power plants 
are located, would reduce the likelihood of an active insider. 

In addition to making changes to specific elements of the DBT for 
nuclear power plants, the commission provided overall policy direction 
on NRC's oversight of security of the sites. In particular, recognizing 
that an attack on a site could exceed the characteristics identified in 
the DBT, the commission directed the staff to continue coordinating 
with DHS and other federal and state authorities to help assure the 
security of nuclear power plants. For example, the commissioners told 
us that NRC works with the Federal Aviation Administration to address 
the threat of air strikes against a site. Similarly, NRC supports and 
participates in DHS comprehensive security reviews of nuclear power 
plant sites. 

Other significant policy direction included the following: 

* The commission affirmed the NRC staff's operating assumption that 
there may be no specific advance warning of an attack on a nuclear 
power plant but indicated that a general warning of a potential attack 
may be provided. 

* The commission directed the staff to continue providing the 
commissioners with assessments of specific adversary characteristics, 
including those not in the revised DBT, and to provide additional 
recommendations as part of the semiannual review of threats to nuclear 
power plants. However, the commission also indicated its expectation 
that there would be a period of "regulatory stability" (a period with 
no major changes to security regulations) in order to allow sites time 
to adjust to the changes already made to the DBT and other security 
requirements. 

* The commission supported the clarification that sites are not 
required to "defeat" an attack, because such a requirement could 
require sites' security forces to employ offensive tactics beyond what 
is allowed under law for private security forces. Rather, the 
commission supported the requirement that sites protect against 
radiological sabotage by preventing the destruction or disablement of 
vital equipment. 

Nuclear Power Plants Made Substantial Changes to Their Security to 
Address the Revised DBT, but NRC Inspections Have Uncovered Problems: 

The four nuclear power plant sites we visited made substantial changes 
after the September 11, 2001, attacks and in response to the revised 
DBT, including measures to detect, delay, and respond to the increased 
number of attackers and to address the increased vehicle bomb size. 
According to NRC, other sites took comparable actions to defend against 
the revised DBT. Despite the industry's considerable efforts, the 
changes have not been completely without problems and licensees can 
continue to make improvements. For example, NRC baseline and force-on- 
force inspections have found that the security changes have not always 
met NRC's requirements. 

Sites Addressed the Increase in the Number of Attackers by Implementing 
Security Enhancements Designed to Detect, Delay, and Respond to an 
Attack: 

The four sites we visited all implemented a "defense-in-depth" 
strategy, with multiple layers of security systems that attackers would 
have to defeat before reaching vital areas or equipment and destroying 
or disabling systems sufficient to cause an elevated release of 
radiation off site. The sites varied in how they implemented these 
measures, primarily depending on site-specific characteristics such as 
topography and on the degree to which they planned to interdict 
attackers within the owner-controlled area and far from the sites' 
vital area, as opposed to inside the protected area but before they 
could reach the vital equipment. (See fig. 1 for a diagram of the areas 
commonly found at nuclear power plants.) NRC officials told us that 
licensees have the freedom to design their protective strategies to 
accommodate site-specific conditions, so long as the strategies satisfy 
NRC requirements and prove successful in a force-on-force inspection. 

Figure 1: Diagram of a Sample Nuclear Power Plant Site: 

[See PDF for image] 

Note: The owner-controlled area refers the land and buildings within 
the site boundary, and the owner can limit or allow access to it for 
any reason. The protected area is within the owner-controlled area and 
requires a higher level of access control. The vital area contains the 
sites' vital equipment, the destruction of which could directly or 
indirectly endanger public health and safety through exposure to 
radiation. 

[End of figure] 

The sites we visited implemented security measures corresponding to the 
three elements generally recognized as constituting an effective 
security system for defending fixed sites. These include early 
detection of an attack, sufficient delay for security officers to 
report to their defensive positions, and capability of the security 
force to respond to the attack: 

* Detection. At all four sites, the owners installed additional cameras 
throughout different areas of the sites and instituted random patrols 
in the owner-controlled areas.[Footnote 19] The owner-controlled areas 
generally contain undeveloped property and administrative buildings 
that would not be targets for terrorists seeking to commit radiological 
sabotage. Nevertheless, by upgrading security in this area, the sites 
increased the chance that they would detect attackers before the 
attackers would be able to approach or infiltrate the protected area, 
where they might be able to gain access to vital equipment. Patrols can 
be used to accommodate areas of the sites that are remote or where the 
view of cameras is obstructed, while cameras provide for a safer 
inspection of questionable activities than sending a security officer. 

* Delay. The sites we visited installed a variety of devices designed 
to delay attackers and allow security officers more time to respond to 
their posts and fire upon attackers. The sites generally installed 
these delay devices throughout the protected areas so that attackers 
would have to defeat multiple security systems before reaching vital 
areas or equipment. For example, the sites installed fences outside the 
buildings housing the reactors and other vital equipment and blocked 
off entrances to make it more difficult for attackers to enter the 
buildings. Similarly, the sites installed a variety of delay devices 
within the reactor and other buildings, some of which are permanent and 
others that security officers would deploy in the event of an attack. 

* Response. Each of the four sites we visited constructed bullet- 
resistant structures at various locations in the protected area or 
within buildings, increased the minimum number of security officers 
defending the sites at all times, and expanded the amount of training 
provided to them.[Footnote 20] Security officers are stationed in the 
bullet-resistant structures or move to them during an attack, at which 
point they can fire at attackers through gun ports while not exposing 
themselves to the attackers' gunfire. (See fig. 2 for an example of a 
bullet-resistant structure.) Having more security officers on duty at 
any given time means that more individuals can respond to more 
locations in the event of an attack. It can also increase the sites' 
ability to detect attackers by allowing more security officers to 
observe the owner-controlled area and monitor video cameras. Security 
managers at each site told us they also made changes to their training-
-for example, to train officers to use new security equipment or to 
comply with NRC's training order, issued at the same time as the 
revised DBT. Moreover, each of the licensees told us they implemented 
measures to comply with NRC's requirements limiting the number of hours 
security officers can work to 72 hours during a 7-day period.[Footnote 
21] The majority of the security officers we interviewed told us that 
their training was adequate or had improved and that they generally did 
not experience fatigue on the job. 

Figure 2: Example of a Bullet-Resistant Structure: 

[See PDF for image] 

[End of figure] 

Security managers at the four sites considered the layouts of their 
sites and the paths that attackers might use to reach vital equipment 
in deciding where to deploy these enhancements. As a result, the sites 
employed different protective strategies that primarily varied by the 
degree to which they implemented an external strategy designed to 
interdict attackers within the owner-controlled area, but far from the 
sites' vital area, rather than an internal strategy designed to 
interdict attackers inside the protected area. For example, one site 
with a predominantly external strategy installed an intrusion detection 
system in the owner-controlled area. While NRC requires all sites to 
have an intrusion detection system at the perimeter of the protected 
area,[Footnote 22] security managers at this site decided to install a 
second intrusion detection system so that security officers would be 
able to identify intruders as soon as they cross into the owner- 
controlled area. The site was able to install such a system because of 
the large amount of open, unobstructed space in the owner-controlled 
area. Similarly, the protective strategy at another site focused on the 
ability of security officers to deny attackers access to the vital area 
buildings. The site uses cameras and patrols to detect attackers in the 
owner-controlled area and deploys security officers in bullet-resistant 
structures. From the structures, located on the roof and attached to 
the walls of the vital area buildings, security officers could fire 
upon attackers before they could enter the buildings. 

In contrast, security managers at the other two sites we visited 
described protective strategies that combined elements of an external 
strategy and an internal strategy. At both sites, the external strategy 
included bullet-resistant structures positioned so that security 
officers could fire on attackers attempting to enter vital area 
buildings. Other security officers are stationed inside the vital area 
buildings and would move to bullet-resistant structures within the 
buildings to interdict attackers who defeat the external security. At 
one of these sites in particular, security managers decided to 
implement a protective strategy that relied more heavily on 
interdicting attackers inside the protected area. The site uses 
elements of an external strategy, such as cameras and patrols for 
detecting attackers in the owner-controlled area, but in contrast to 
the sites described above, relies to a lesser extent on security 
officers to stop the attackers in the owner-controlled area. Instead, 
security managers told us they had implemented an internal protective 
strategy by identifying "choke points"--locations inside the protected 
area attackers would need to pass before reaching their targets--and 
installing bullet-resistant structures at the choke points where 
officers would be waiting to interdict the attackers. Security managers 
at the site also told us one of the reasons for implementing a more 
internal strategy was their desire to maintain radiation doses to 
security officers as low as is reasonably achievable. In particular, 
the internal strategy allowed the site to not install bullet-resistant 
structures on one side of the site, where security officers who would 
be stationed in the structures could receive elevated radiation doses. 

In addition to the security enhancements we observed, security managers 
at each site described changes they plan to make as they continue to 
improve their protective strategies, such as adding fencing to block a 
path attackers might use to enter the protected area and a device at 
the entrance to the site that can detect explosives. Security managers 
at three of the sites we visited also told us the number of security 
officers on duty at any one shift exceeded the minimum number of 
security officers that NRC requires be dedicated to responding to 
attacks.[Footnote 23] (The fourth site maintained the minimum number of 
armed dedicated security officers.) According to NRC's analysis, sites 
typically exceeded the minimum number of responders required by NRC. 

Sites Addressed the Increase in the Size of a Vehicle Bomb by Designing 
Comprehensive Systems of Sturdy Barriers: 

To protect against the increase in the vehicle bomb size, the licensees 
at the sites we visited designed comprehensive systems consisting of 
sturdy barriers to prevent a potential vehicle bomb from approaching 
the sites and to channel vehicles to entrances where security officers 
could search them for explosives and other prohibited items. Prior to 
increasing the maximum size vehicle bomb sites must defend against, NRC 
required the sites to have a vehicle barrier system encircling the 
reactors and other vital equipment and set at a distance far enough 
from the plants to prevent a smaller vehicle bomb from damaging vital 
equipment and releasing radiation. After NRC increased the maximum size 
of the vehicle bomb in the revised DBT, plants installed a second 
vehicle barrier system at an even greater distance from the vital 
equipment, while also keeping the original vehicle barrier systems as a 
second layer of defense. 

At the sites we visited, the new vehicle barrier systems consisted of 
rows of large steel-reinforced concrete blocks, or (at one plant) large 
boulders weighing up to 7 tons in combination with piles of smaller 
rocks. (See fig. 3 for an illustration of a vehicle barrier system.) 
The vehicle barrier systems either completely encircled the plants 
(except for entrances manned by armed security officers) or formed a 
continuous barrier in combination with natural or manmade terrain 
features, such as bodies of water or trenches, that would prevent a 
vehicle from approaching the sites. 

Figure 3: Example of a Vehicle Barrier System: 

[See PDF for image] 

[End of figure] 

Licensees at the four sites adapted their vehicle barrier systems to 
the unique conditions at each site. The vehicle barrier systems also 
shared many features in common and generally consisted of a combination 
of the following basic elements: 

* Vehicle searches. Generally, the security managers told us they 
implemented procedures to search vehicles at the entry point to the 
outer vehicle barrier systems. (NRC requires sites to search all 
vehicles capable of carrying more than a certain amount of TNT and to 
search a random sample of vehicles capable of carrying a smaller amount 
of explosives). Examples of search procedures included visual 
examination of the compartments of vehicles and use of detection 
equipment to test for explosives. Security managers told us security 
officers would conduct a second search of all vehicles, regardless of 
size, at a second checkpoint where vehicles pass through the inner 
vehicle barrier system. During this search, security officers would 
look for weapons and other prohibited equipment in addition to any 
explosives. 

* "Overwatches." The sites stationed security officers in bullet- 
resistant structures, or "overwatches," from which the officers could 
observe the vehicle searches and provide backup support in case of an 
attack. Like the other bullet-resistant structures installed by the 
sites, these structures included gun ports for firing at attackers. 

* "Active" vehicle barrier systems. These systems were installed in the 
roadways leading into the plants and were designed to block 
unauthorized vehicles from entering the site. They consisted either of 
steel plates that could be raised or lowered or rolling gates. (See 
fig. 4 for an example of an active vehicle barrier system.) Security 
officers in multiple locations, such as alarm stations and overwatches, 
could activate the systems if security officers manning the vehicle 
entrances, who are more vulnerable to attack, were unable to do so. At 
two of the plants, the barriers were always in the closed position and 
required two security officers at separate locations to open them. At 
the other two plants, the barriers were generally in the open position 
but could be closed by a single security officer to prevent 
unauthorized entry. 

Figure 4: Example of an Active Vehicle Barrier System: 

[See PDF for image] 

[End of figure] 

In some cases, the new vehicle barrier systems at the sites we visited 
appeared to exceed the requirements necessary to protect against the 
revised DBT. For example, security managers at one site told us that 
the vehicle barrier system was wider than necessary in order to protect 
against the vehicle bomb. Furthermore, in at least some areas of the 
sites, the new vehicle barrier systems were farther from the reactors 
and other vital equipment than necessary to protect the sites against 
the size of vehicle bomb in the revised DBT. In particular, security 
managers at the site with a more external protective strategy decided 
to take advantage of the large amount of open, unobstructed property 
surrounding the site to create a large zone between the vehicle barrier 
system and the site buildings. Although we generally toured the 
complete perimeter of the vehicle barrier systems at the four sites, we 
did not calculate how far the barrier systems were installed from the 
vital equipment, test the equipment performance, or determine how well 
security officers conducted vehicle searches. Like other aspects of 
security at the plants, these factors would affect how well the vehicle 
barrier systems would work in the event of a terrorist attack. 

In addition, the sites implemented other related measures, such as 
winding lanes designed to cause vehicles to slow down as they approach 
entrances; emergency exits to facilitate evacuation of employees from 
the plant; devices to block unauthorized trains from reaching the 
plant; parking lots outside the vehicle barrier system for use during 
an outage to limit the number of additional vehicles entering the 
vehicle barrier systems and requiring searches; and, at one site, 
receiving deliveries at an off-site warehouse to limit the number of 
trucks entering the site. 

Sites Have Generally Complied with NRC Security Requirements and 
Performed Well in Force-on-Force Inspections, but Problems Remain: 

As of November 1, 2005, NRC had completed force-on-force inspections-- 
testing sites' ability to defend against the revised DBT--at 20 sites. 
NRC officials told us, and our review of baseline and force-on-force 
inspection reports indicated, that plants have generally complied with 
their security plans and other NRC security requirements and have 
generally performed well during force-on-force inspections.[Footnote 
24] However, we also noted from the reports, as well as from our own 
observations, that sites have encountered a range of problems in 
meeting NRC security requirements, including a force-on-force 
inspection in which the site had problems demonstrating it could defend 
against the revised DBT. (According to NRC officials, inspectors do not 
leave the site at which a problem is identified until it is corrected 
or until sufficient compensatory measures are put in place.) Twelve of 
the 18 baseline inspection reports and 4 of the 9 force-on-force 
inspection reports we reviewed identified problems or items needing 
correction. These findings, such as failures in the intrusion detection 
system at one site and not including certain elements of training at 
several sites, demonstrate that NRC's baseline and force-on-force 
inspections are important to identifying problems that need correction. 
(See app. II for a discussion of the findings in the force-on-force and 
baseline inspection reports we reviewed.) 

During a force-on-force inspection at one site, we observed that 
although the security measures appeared impressive, the site's ability 
to defend against the DBT was at best questionable. The site's security 
measures were similar to those we observed at other sites, such as an 
intrusion detection system equipped with cameras for assessing alarms, 
bullet-resistant structures both in the protected and vital areas, and 
a vehicle barrier system consisting of large concrete blocks and large 
boulders. However, some or all of the attackers were able to enter the 
protected area in each of the three exercise scenarios. Furthermore, 
attackers made it to the targets in two of the scenarios, although the 
outcomes of the two scenarios were called into question by 
uncertainties regarding whether the attackers had actually been 
neutralized before reaching the targets. NRC, in turn, raised concerns 
about the site's lack of "defense in depth" and concluded that it could 
not validate the licensee's protective strategy in the two scenarios. 
NRC noted that security officers' ability to interdict attackers was 
impacted due to problems in the site's detection and assessment, and 
that, in two of the scenarios, security officers left the external 
bullet-resistant structures to which they were assigned and 
transitioned to internal positions once they could account for the 
number of attackers in the revised DBT. This meant that the security 
officers left positions that covered a "breach" the attackers had made 
in the protected area perimeter. As a result of the inspection, NRC 
required the licensee to install additional security equipment 
immediately after the inspection, NRC inspectors remained on site until 
the equipment was put in place, and NRC decided to conduct another 
force-on-force inspection at the site. 

At the follow-up force-on-force inspection at the same site, which we 
also observed, the licensee told us it had spent an additional $37 
million to improve security in the 6 months following the first 
inspection. Some of these changes were clearly visible, such as 
elevating the bullet-resistant structures that had been on the ground 
to give officers greater visibility and firing opportunities, razing 
several buildings to reduce opportunities for attacker concealment, and 
increasing the distance between the vehicle barrier system and the 
protected area in a part of the site. The licensee also told us about 
other changes directly related to the internal aspect of the protective 
strategy, including positioning more security officers within the vital 
area, installing additional cameras to increase security officers' 
ability to detect attackers, and creating new bullet-resistant 
structures that provided additional protected positions for firing upon 
the attackers. From the second exercise, NRC officials concluded that 
they could evaluate the protective strategy and that the site had 
adequately defended against a DBT-style attack. 

In addition to our observations of security during force-on-force 
inspections, GAO security experts who accompanied us to the four other 
sites we visited suggested a number of opportunities to improve 
security at the sites. While our experts did not find a lack of 
compliance with NRC regulations or an inability to defend the sites 
against the adversary characteristics in the revised DBT, the 
suggestions support our assessment that security at nuclear power 
plants is an ongoing process of identifying and implementing potential 
improvements. For example, at one site, we observed a bullet-resistant 
enclosure in which curtains--installed to reduce glare from the sun-- 
obstructed the view through windows, and video equipment associated 
with surveillance cameras blocked access to several gun ports. We 
suggested that the site consider replacing the curtains with tinted 
glass and providing the security officer in the bullet-resistant 
enclosure with better access to the gun ports. At another site, we 
suggested that the addition of a bullet-resistant structure on one side 
of the site would provide the site's security force with greater 
opportunity to interdict attackers entering on that side of the site. 

NRC Has Significantly Improved the Force-on-Force Inspection Program, 
but Challenges Remain: 

NRC has made a number of improvements to the force-on-force inspection 
program, several of which address recommendations we made in our 
September 2003 report on NRC's oversight of security at commercial 
nuclear power plants. We had made our recommendations when NRC was 
restructuring the force-on-force program to provide a more rigorous 
test of security at the sites in accordance with the DBT, which was 
also under revision.[Footnote 25] For example, we had recommended that 
NRC strengthen the force-on-force inspections by (1) conducting the 
inspections more frequently at each site, (2) using laser equipment to 
better simulate attackers' and security officers' weapons, and (3) 
requiring the inspections to make use of the full terrorist 
capabilities stated in the DBT, including the use of an adversary force 
trained in terrorist tactics. 

NRC has taken a number of actions as part of its restructuring of the 
force-on-force program that satisfy the recommendations we made to 
strengthen the program. For example, NRC has begun conducting the 
exercises more frequently at each site and is using laser equipment to 
simulate weapons. Furthermore, the attackers in the force-on-force 
exercise scenarios we observed used many of the adversary 
characteristics of the revised DBT, including the number of attackers 
in the revised DBT, a vehicle bomb, a passive insider, and explosives. 
In addition, NRC officials told us that the adversaries were trained in 
military tactics. Nevertheless, in observing three force-on-force 
inspections and discussing the program with NRC officials, we noted the 
following issues that continue to warrant NRC's attention: 

* Problems with laser equipment. At the three force-on-force 
inspections we observed, the sites used laser equipment to simulate 
firing live weapons. In general, the equipment appeared to help make 
the inspections a realistic test of security at the sites. For example, 
laser equipment provides a much more reliable account of shots fired in 
comparison with the equipment NRC and the sites had been using, which 
relied on the judgment of individual participants to determine shooting 
accuracy. However, problems in using the equipment contributed to NRC's 
limited ability to evaluate security at one of the sites. In part 
because of problems with the laser equipment, NRC decided to conduct a 
second force-on-force inspection at this site. The second inspection 
made better use of the laser equipment, which proved to be a valuable 
tool in determining that several security officers engaged attackers 
unsuccessfully by firing at the attackers while they were too far away. 
NRC raised this issue to the licensee in the context of improving 
training so that security officers would not waste ammunition on 
targets that are beyond the range of their weapons. 

* Inspection schedules. The way in which NRC schedules force-on-force 
exercises may create artificialities that enable sites to perform 
better than they otherwise would. NRC officials said they notify sites 
of the date of their force-on-force inspection only 8 to 12 weeks in 
advance. Nevertheless, NRC may be able to further reduce the 
artificiality of the inspection schedules and thereby enhance its 
ability to test security at the sites. For example, in each of the 
exercises we observed, NRC followed the same schedule for conducting 
nighttime and daytime attacks. Furthermore, the adversary force 
typically initiated the attack soon after the opening of the exercise 
"window" (the agreed-upon time for the exercise to begin). 
Consequently, the sites' security forces might have been able to 
anticipate the approximate time that the attack would begin, and 
industry observers from other sites might have more information than 
necessary prior to inspections at their own sites about NRC's standard 
practices for conducting the inspections. NRC officials told us that, 
while the attacks began soon after the opening of the exercise window 
in the exercises we observed, the attackers do sometimes wait longer in 
order to increase the level of uncertainty among the site's security 
force and thereby create a more realistic scenario. 

* Testing of sites' internal security strategies. Given the amount of 
resources invested in preparing for and implementing a force-on-force 
inspection, we believe inspections should test the full extent of 
sites' "defense-in-depth" strategies, including both the external and 
internal elements of the strategies. However, the force-on-force 
exercises end when a site's security force successfully stops an 
attack. Consequently, if the security force stops an attack before the 
attackers enter the vital area, NRC would not have an opportunity to 
observe how the security force would perform in the event that the 
attackers successfully defeat the site's external security strategy. In 
a number of the force-on-force exercises we observed, the security 
force did, in fact, stop the attackers early in the scenario. According 
to NEI officials, force-on-force inspections would be more valuable if 
NRC allowed the adversaries to challenge each layer of defense until 
reaching their targets, or being defeated at the last possible point of 
defense. NRC officials also told us such an approach is worth 
considering but that NRC would have to first determine how to implement 
it. 

* Operational security. At two of the force-on-force inspections we 
observed, we noted areas in which "operational security"--the 
protection of information about the planned scenarios for the mock 
attacks--could be improved. For example, during a safety "walk down"-- 
a physical site check conducted prior to every exercise scenario to 
ensure the safety of exercise participants--a site employee made 
motions that may have alerted security officers to the targets the 
adversaries would be trying to reach that evening. In another 
inspection, security officers could observe adversaries getting into 
position inside the protected area prior to the start of an exercise, 
potentially providing clues about the route the adversaries would use 
to enter the site. We also observed that each force-on-force exercise 
was attended by a large number of people who had access to scenario 
information, after signing a nondisclosure form, thus increasing the 
chance that details about an exercise scenario might be compromised. 
While we recognize that procedures such as safety walk downs and 
prepositioning of adversary teams are necessary to the proper conduct 
of the force-on-force inspections, lapses in operational security have 
the potential to give security officers knowledge that would allow them 
to perform better than they would otherwise and raise questions about 
whether the force-on-force inspections are a true test of the sites' 
protective strategy. According to NRC officials, NRC inspectors have 
been instructed to be vigilant regarding any indications that a site's 
security force may have received advance knowledge of an attack 
scenario, and procedures for safety walk downs have been revised to 
improve operational security. 

* Standards for controllers. NRC relies on the sites to assign and 
train controllers to observe each participant (both the adversaries and 
security officers) in the force-on-force inspections.[Footnote 26] In 
the three inspections we observed, the level of security expertise and 
training among the controllers varied among the sites. For example, one 
site assigned as controllers plant employees who did not have security- 
related backgrounds but who volunteered to help. In its force-on-force 
inspection report for this site, NRC concluded that the level of 
controller training was a factor in the force-on-force exercises not 
being brought to a definitive conclusion. (As discussed above, NRC 
decided to conduct another force-on-force inspection at this site.) In 
contrast, another plant used personnel with security backgrounds. NEI 
has prepared a set of guidelines for controllers in force-on-force 
inspections that NRC has reviewed. NEI has also created a controller- 
training workshop in which NEI shares lessons learned from force-on- 
force exercises. 

* Quality of feedback to licensee. The quality of the feedback among 
the force-on-force inspections we observed was inconsistent. In 
particular, during the first inspection, NRC failed to discuss with the 
licensee several potential problems raised by the NRC team after each 
scenario. In the two subsequent inspections we observed, NRC appeared 
to have improved the quality of its feedback to the licensees. 
Specifically, the team leader provided the licensee with concise 
feedback that accurately reflected what the team members had expressed 
in closed NRC meetings. An NRC official told us that, based on comments 
from us as well as from NRC team members, NRC took measures to improve 
the quality of the feedback. 

* Force-on-force inspection schedule. So far, NRC is on schedule to 
conduct the first round of force-on-force inspections at all sites 
within 3 years. As we reported in 2004, NRC is planning to conduct an 
inspection at each site every 3 years instead of every 8 years, as the 
agency had been doing.[Footnote 27] NRC initiated a new force-on-force 
program in November 2004, together with a 3-year schedule to complete 
inspections at all sites, after the revised DBT took effect on October 
29, 2004. NRC officials told us they had completed inspections at 20 
(or about 31 percent) of the 65 sites as of November 1, 2005. 
Furthermore, NRC officials told us that three teams are conducting the 
inspections and that NRC is hiring additional force-on-force personnel. 
Given the importance of the force-on-force inspections in demonstrating 
how well a nuclear power plant might defend against a real-life threat, 
we believe it is important that NRC devote the necessary resources to 
ensure that it continues to meet the inspection schedule. 

Conclusions: 

The nuclear power industry and NRC have taken very seriously the need 
to protect nuclear power plants against a potential terrorist attack 
and have made important investments to this end. However, NRC's process 
for revising the DBT for nuclear power plants raises a fundamental 
question--the extent to which the DBT represents the terrorist threat 
as indicated by intelligence data versus the extent to which it 
represents the threat that NRC considers reasonable for the plants to 
defend against. Specifically, NRC's process for deciding on the DBT 
raised the possibility that the industry may have inappropriately 
influenced the staff's interpretation of intelligence data. The NRC 
threat assessment staff obtained the views of the nuclear industry on a 
draft of the revised DBT while they continued to assess intelligence 
information, and the staff made industry-recommended changes to the DBT 
even though the intelligence information had not changed. We recognize 
that NRC should and would want to obtain feedback from the industry and 
other stakeholders on the implications of the proposed changes before 
finalizing the DBT. In addition, NRC has stated that it has altered its 
process for obtaining industry feedback so that the threat assessment 
staff interacts with industry only after it has made its proposals for 
changes to the DBT. However, this approach does not entirely eliminate 
the appearance of industry influence. Threat assessment is a continuous 
process, and this sequential approach would still allow for 
interactions between the agency's threat assessment staff and the 
nuclear industry. Assigning responsibility for obtaining feedback from 
the nuclear industry to an office within NRC other than the Threat 
Assessment Section would further reduce any appearance of industry 
influence on the process of assessing the terrorist threat to nuclear 
power plants. The commissioners would then be able to review the threat 
assessment staff's recommended changes to the DBT with confidence that 
the recommendations are based strictly on an assessment of the threat. 
In making the final decision to revise the DBT, the commissioners would 
also consider industry feedback on the staff's recommendations. 

Furthermore, the commissioners did not have explicit criteria that they 
used as the basis for removing certain weapons from the DBT recommended 
by the NRC staff. Consideration of what is reasonable for a private 
security force to defend against, as well as industry views on proposed 
changes to the DBT, is an appropriate function of the commissioners. 
However, explicit criteria setting out the factors and how they would 
be weighed to determine what adversary characteristics are not 
reasonable for a private security force to defend against would have 
provided greater transparency for the commissioners' decisions to 
exclude certain characteristics from the DBT. Such criteria would also 
potentially increase the rigor and consistency of the process. The 
underlying process used by NRC was logical and well defined and should 
enable NRC to produce a more credible DBT if these shortcomings are 
addressed. 

In our visits to nuclear power plants, we saw a clear connection 
between the changes in the DBT and the plants' recent security 
enhancements. The plants' response to the revised DBT and other NRC 
orders following the September 11 terrorist attacks has been 
substantial and, in some cases, has gone beyond what was required. 
Nevertheless, because the plants essentially designed their security to 
defend against the DBT outlined by NRC, their capability to defend 
against an attack is essentially limited to how similar such an attack 
would be to the DBT. Therefore, it is imperative that NRC and the 
plants continue to work with DHS and other federal, state, and local 
authorities to ensure they have coordinated their efforts to defend 
plants in the event of an attack, particularly one that exceeds the 
adversary characteristics in the revised DBT. Furthermore, although 
security has improved, the results of NRC's baseline and force-on-force 
inspections conducted thus far have uncovered some problems that needed 
to be addressed. Moreover, the effectiveness of any nuclear power 
plant's security depends on the various parts and systems working well 
together during the stress of an actual attack. Therefore, NRC's 
continued vigilance at the plant level, especially in conducting force- 
on-force inspections, is needed to ensure that plants are consistently 
well protected. 

In conjunction with revising the DBT, NRC has implemented improvements 
to its force-on-force inspection program that put the agency in a 
better position to evaluate the nuclear power plants' protective 
strategies. These improvements have addressed several of our previous 
recommendations regarding the force-on-force inspections. However, in 
observing three inspections, we noted additional opportunities for 
improvement, such as artificialities that could be further reduced to 
better test how plants would respond to an actual terrorist attack. 
Making further improvements to the force-on-force program would enhance 
NRC's ability to assure the public and Congress that nuclear power 
plants are capable of defending against a DBT-style terrorist attack. 

Recommendations for Executive Action: 

To improve the process by which NRC makes future revisions to the DBT 
for nuclear power plants, we recommend that the NRC commissioners take 
the following two actions: 

* Assign responsibility for obtaining feedback from the nuclear 
industry and other stakeholders on proposed changes to the DBT to an 
office within NRC other than the Threat Assessment Section, so that the 
threat assessment staff is able to assess the terrorist threat to 
nuclear power plants without creating the potential for or appearance 
of industry influencing their analysis. The commissioners, in turn, 
could consider both the staff's analysis of the terrorist threat and 
industry feedback to make the final determination as to whether and how 
to revise the DBT. 

* Develop explicit criteria to guide the commissioners in their 
deliberations to approve changes to the DBT. These criteria should 
include setting out the specific factors and how they will be weighed 
in deciding what characteristics of an attack on a nuclear power plant 
would constitute an enemy of the United States, or otherwise would not 
be reasonable for a private security force to defend against. 

We further recommend that the NRC commissioners continue to evaluate 
and implement measures to further strengthen the force-on-force 
inspection program. For example, NRC may be able to identify and reduce 
artificialities associated with the inspections to better test how 
nuclear power plants would respond to an actual terrorist attack. 

Agency Comments and Our Evaluation: 

We provided a draft of this report to NRC for its review and comment. 
In its written comments (see app. III), NRC commended GAO's effort to 
ensure that the report is accurate and constructive. It also provided 
additional clarifying comments on two areas of the report pertaining to 
the process NRC used in 2003 to revise the DBT for nuclear power 
plants. First, NRC stated that the report should provide a better 
description of the context for the process by which the agency obtained 
industry input and the appearance of industry influence on the 
development of the revised DBT. NRC wrote that the agency made a 
deliberate decision to develop the revised DBT while simultaneously 
(rather than sequentially) seeking input from stakeholders, including 
the nuclear industry. NRC stated that this was a departure from its 
typical approach and was intended to advance public health and safety 
and the common defense and security, similar to other government 
actions taken after the September 11, 2001, terrorist attacks. In 
addition, NRC stated that it has returned to its normal sequential 
approach to developing DBT revisions and seeking input from 
stakeholders. 

We are pleased that NRC recognizes the need to separate the process of 
analyzing intelligence information from seeking input from 
stakeholders, including the nuclear industry. In response to NRC's 
earlier comments on the classified version of this report, which were 
essentially the same, we revised the reports to clarify that NRC 
deliberately decided to develop the revised DBT while simultaneously 
obtaining stakeholder input to speed up the process in the aftermath of 
the September 11, 2001, terrorist attacks. However, whether NRC chooses 
to use a simultaneous or sequential process, we continue to believe 
that the best approach would be to insulate the threat assessment staff 
from interactions with the nuclear industry by assigning responsibility 
for such interactions to a different office in NRC. This would best 
separate the fact-based analysis of the threat to commercial nuclear 
power plants from policy-level considerations regarding what is 
reasonable for a private security force to defend against. We also 
clarified our recommendation to indicate our view that the threat 
assessment staff should be insulated from interacting with the nuclear 
industry and other stakeholders. 

Second, regarding the criteria the commission used to make decisions 
regarding the DBT, NRC wrote that a more comprehensive discussion in 
the report of the commission's deliberative decision-making process 
would provide important perspective. NRC stated that the agency first 
established a DBT for nuclear power plants in the late 1970s and has a 
long history in this area. Furthermore, NRC wrote that the commission's 
decision-making authority does not require, and could be unduly 
restricted by, detailed prescriptive criteria. Finally, NRC stated its 
view that the basis for the commission's policy decisions and direction 
to the NRC staff with regard to the DBT are sufficiently articulated in 
the commission's voting record and related staff requirements 
memorandums. 

We revised the reports to include NRC's view that the basis for the 
commission's policy decisions regarding the DBT is articulated in the 
commission's voting record and related staff requirements memorandum. 
However, based on our review of the voting record and staff 
requirements memorandum, as well as other documents related to the 
April 2003 revised DBT, we remain concerned that the basis for how the 
commissioners made decisions to exclude certain characteristics from 
the DBT is not as transparent as it could be. We did not find that the 
commissioners agreed upon a definition of "enemy of the United States" 
or explicit criteria for what adversary characteristics would not be 
reasonable for a private security force to defend against. For example, 
the memorandum accompanying the commission's April 2003 decision 
approving changes to the DBT for nuclear power plants did not provide 
the reason for the commission's decision to remove two weapons the NRC 
threat assessment staff had recommended for inclusion. Rather, the 
voting record showed that individual commissioners used differing 
criteria and emphasized different factors, such as cost or practicality 
of defensive measures. The staff requirements memorandum set forth the 
general criteria that a civilian security force cannot reasonably be 
expected to defend against all threats. Furthermore, the intent of our 
recommendation that NRC develop criteria for what adversary 
characteristics constitute an enemy of the United States, or otherwise 
would not be reasonable for a private security force to defend against, 
is not to restrict the commission's decision-making authority through 
detailed prescriptive criteria. Instead, the intent of our 
recommendation is to have general criteria or definitions to guide the 
commissioners' decisions and to provide greater transparency for 
commission decisions, the details of which are safeguards information 
and withheld from the public. 

Finally, NRC commented that NRC and GAO staffs discussed potential 
issues related to the draft report that needed to be addressed. NRC 
also wrote that the draft report contained safeguards information, 
which should be removed prior to the report being made public. The 
potential issues have been resolved, and we have revised the report for 
the purpose of removing safeguards information. The resulting report is 
substantially the same as the classified version of the report, with 
the exception that the classified version contains additional details 
about the DBT and security at nuclear power plants. 

As agreed with your office, unless you publicly announce the contents 
of this report earlier, we plan no further distribution until 30 days 
from the report date. At that time, we will send copies to interested 
congressional committees, the Chairman of NRC, and other interested 
parties. We also will make copies available to others upon request. In 
addition, the report will be available at no charge on the GAO Web site 
at [Hyperlink, http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-3841 or [Hyperlink, wellsj@gao.gov]. Contact 
points for our Offices of Congressional Relations and Public Affairs 
may be found on the last page of this report. GAO staff who made major 
contributions to this report are listed in appendix IV. 

Sincerely yours, 

Signed by: 

Jim Wells: 
Director, Natural Resources and Environment: 

[End of section] 

Appendixes: 

Appendix I: Scope and Methodology: 

To examine the process the Nuclear Regulatory Commission (NRC) used to 
develop the April 2003 design basis threat (DBT) for radiological 
sabotage applied to nuclear power plants, we analyzed NRC's 
documentation of the process and conducted interviews with NRC threat 
assessment staff and other officials. In particular, we compared the 
adversary characteristics of the April 2003 revised DBT approved by the 
commissioners with the adversary characteristics in the previous DBT, 
as described in a February 2000 NRC staff position paper; the January 
2003 draft DBT provided to stakeholders for comment; and the NRC 
staff's April 2003 recommended changes to the DBT submitted to the 
commissioners. Furthermore, for each component of NRC's process, we 
analyzed documents and conducted a series of interviews: 

* To examine the role of intelligence analysis, we analyzed the NRC 
staff's reports on the terrorist threat to nuclear power plants and the 
results of their analysis of intelligence information on terrorist 
activities worldwide. The three key reports we analyzed included an 
October 2002 report on the use of vehicle bombs; a November 2002 report 
on the potential use of other adversary characteristics against nuclear 
power plants; and the April 2003 report that included the staff 
recommendations on the DBT. To obtain further insight into the NRC's 
use of intelligence information, we interviewed NRC officials, 
including the head of NRC's Threat Assessment Section; reviewed a 
description of the adversary characteristics screening process; and 
received briefings on the process from NRC. We also interviewed 
officials from other federal agencies, including the Department of 
Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). 
NRC redacted text from a number of the documents provided to us if the 
text contained classified information from other federal agencies, 
including the Department of Energy (DOE). As agreed with NRC, we 
identified the selected portions of the redacted text that we wanted to 
review, and NRC requested permission from the other agencies to provide 
the text to us. All of the agencies NRC contacted except one granted 
permission to release the redacted text to us. 

* We compared NRC's April 2003 revised DBT with DOE's October 2004 DBT 
and February 2004 Terrorist Adversary Capabilities List and interviewed 
DOE Office of Security officials regarding the DOE DBT and differences 
with the NRC DBT. We also reviewed the September 2004 final report of 
the DOE DBT re-examination task force. We did not compare the 
implementation of security measures at DOE sites to defend against the 
DOE DBT with security at commercial nuclear power plants. 

* To examine NRC's consultation with the nuclear industry, we reviewed 
the written comments submitted by the Nuclear Energy Institute (NEI) on 
the January 2003 draft DBT and compared NEI's comments with the changes 
the NRC staff made to the draft DBT. We also interviewed NEI officials 
and senior officials at the nuclear power plant sites we visited, 
including some who served on the NEI working group responsible for 
security matters. 

* To examine the decisions by the NRC commission, we analyzed the 
commission voting record (including written comments of individual 
commissioners), the April 2003 memorandum summarizing the commission's 
final decisions, and the NRC regulation on enemy of the United States 
(10 C.F.R. § 50.13). Furthermore, we interviewed three of the four 
commissioners who were serving on the commission at the time the DBT 
was revised and who participated in the decision-making 
process.[Footnote 28] We interviewed the three commissioners as a group 
in a meeting that was not subject to the requirements of the Government 
in the Sunshine Act.[Footnote 29] This meant that the commissioners 
could discuss previous actions, including their April 2003 decisions on 
changes to the DBT, but not the formulation of future policy. For 
example, we did not ask the commissioners about the potential for 
future changes to the DBT. In addition to this meeting, we met 
individually with the two commissioners who assumed their posts in 2005 
and did not participate in the decision-making process for the April 
2003 revised DBT. 

To determine what actions nuclear power plants have taken to enhance 
security in response to the revised DBT, we interviewed staff from 
NRC's Office of Nuclear Security and Incident Response, reviewed 
security orders NRC has issued since September 11, 2001, and visited a 
nonprobability sample of four nuclear power plant sites.[Footnote 30] 
We do not name the sites we visited in this report because information 
about security at particular sites is sensitive and considered 
safeguards information, and because the objective of our visits was to 
provide a general description of the changes in security sites 
implemented in response to the revised DBT, rather than the changes at 
a particular site. Prior to our site visits, we observed a baseline 
inspection at one site and a multiexercise force-on-force inspection at 
another site in order to better familiarize ourselves with NRC security 
requirements as well as sites' security equipment and strategies. We 
selected these two sites based on the timing of the activities. 

To select the nonprobability sample of four sites we visited, we first 
eliminated certain sites, such as those we had recently visited for 
security-related work (including the two sites where we observed NRC 
inspections) and sites frequently visited by Congress. We then selected 
one site from each of the four NRC regions using the following 
criteria: 

* sites representing different sizes and types of licensees, including 
licensees that own or operate a single nuclear power plant site, 
licensees that own or operate two to six sites, and licensees that own 
or operate seven or more sites; 

* sites with different surroundings, such as different topography and 
proximity to water, in order to consider the effect of such factors on 
sites' security strategies; 

* sites with security forces hired both directly as site employees as 
well as through a contractor, including one site that uses security 
officers employed by Wackenhut Corporation, which provides security 
services to about half of the nuclear power plant sites; 

* sites with the two different categories of reactors licensed by NRC 
for operation in the United States--two sites with boiling-water 
reactors and two sites with pressurized-water reactors; and: 

* sites with different numbers of reactors. 

At each of the four sites, we used a semistructured guide to interview 
security managers and other site officials, and interviewed a random 
selection of security officers. We worked with site management so that 
our interviews with the security officers did not interfere with their 
duties. We conducted individual interviews with security officers in 
private rooms, without the attendance of plant management or other 
plant staff. We also examined security equipment and reviewed 
documents, including security plans, protective strategy documents, 
safeguards event logs, security officer work-hour records, training 
materials, and equipment testing records. GAO staff with a professional 
background in security accompanied us on our visits in order to provide 
the expertise needed to fully comprehend the sites' security equipment 
and strategies. 

In addition to site visits, we reviewed 9 of the 16 force-on-force 
inspection reports and a sample of 18 baseline inspection reports that 
NRC had completed between November 2004 and the time we reviewed the 
reports.[Footnote 31] The 18 baseline inspection reports we reviewed 
consisted of reports provided by NRC from each of the four regions, 
plus additional reports we randomly selected ourselves.[Footnote 32] 
Time constraints prevented us from reviewing additional reports. We 
also discussed the revised DBT and security improvements at nuclear 
power plant sites with the Nuclear Energy Institute and the Project on 
Government Oversight, an independent nonprofit organization.[Footnote 
33] 

To review NRC's progress in strengthening the conduct of force-on-force 
inspections, we observed a total of three inspections at two sites. Two 
of the inspections were at a site where NRC decided to conduct a second 
inspection as a result of the agency's limited ability to evaluate 
security during the first inspection. After the first inspection at 
this site, but before the second, we also attended a meeting at the 
site in which the licensee briefed NRC on security improvements the 
site had made in response to the first inspection, and we observed 
these improvements. GAO staff with a professional background in 
security accompanied us to the third inspection. In addition, as 
discussed above, we reviewed NRC reports on 9 of the 16 force-on-force 
inspections NRC had completed at the time we reviewed the reports. 
Finally, we interviewed NRC officials responsible for implementing the 
force-on-force inspection program. We conducted our work from November 
2004 through January 2006 in accordance with generally accepted 
government auditing standards. 

[End of section] 

Appendix II: Details of Findings from NRC Reports on Baseline and 
Force- on-Force Inspections: 

Of the 27 baseline and force-on-force inspection reports we reviewed, 
NRC identified no findings in 11 of the reports but did describe a 
variety of problems with the sites' security in the remaining 16. The 
reports we reviewed included one on a force-on-force inspection we 
observed, in which NRC required the licensee to implement measures to 
address weaknesses in the site's protective strategy and decided to 
return for a second force-on-force inspection. The following are 
additional examples of NRC findings from the 16 reports, including 
corrective actions taken by the licensees:[Footnote 34] 

* In a baseline inspection at a site, several alarms failed to activate 
during a test of the intrusion detection system, which alerts security 
officers to the occurrence and location of a breach. Further testing 
identified multiple alarms that were not functioning properly, and the 
site subsequently declared the entire intrusion detection system 
inoperable. Prior to leaving the site, NRC inspectors confirmed that 
the site implemented compensatory measures to address problems with the 
intrusion detection system, and NRC determined that further inspection 
of the site at a later date was warranted. According to NRC, the 
subsequent inspection at the site confirmed that the problem had been 
corrected. 

* During a force-on-force exercise at another site, NRC observed two 
officers performing duties other than their assigned patrols of the 
owner-controlled area. The patrols are a component of NRC's requirement 
for continuous surveillance of the owner-controlled area. Further 
inspection revealed that the security officers manning the site's 
central and secondary alarm stations were unaware that the owner- 
controlled area was not being continuously patrolled. In the event of 
an attack, owner-controlled area observations can be crucial both for 
setting a response in motion by detecting intruders as early as 
possible and for providing information about where attackers have 
entered the site and where they are going so that security officers 
know how to respond. According to NRC, the licensee took immediate 
corrective action. Also during this inspection, NRC observed that the 
licensee deployed too many officers in the force-on-force scenarios as 
a result of a misunderstanding. In particular, the licensee had 
temporarily increased the number of dedicated responders above the 
minimum listed in the security plan to respond to the increased 
national threat level. However, according to NRC, the additional 
officers did not play a role in stopping the attackers in the 
scenarios. 

* In a baseline inspection, NRC observed three examples of failure to 
perform proper searches of personnel entering the protected area. For 
example, a security officer did not examine items that had alarmed a 
metal detector and allowed an individual to collect and carry the items 
into the protected area without further examination. Based on 
discussions with security officers and supervisors, NRC found that this 
deficiency was routine and commonly accepted at the site. NRC concluded 
that this situation had the potential to reduce the overall 
effectiveness of the protective strategy by allowing the uncontrolled 
introduction of weapons or explosives into the protected area. 
According to NRC, the licensee took immediate corrective action, and 
security staff were required to attend remedial training on search 
techniques and policy. 

* In a force-on-force exercise, the attackers were able to destroy 
three out of four targeted components. NRC observed that the attackers 
faced an insufficient level of delay, which allowed them to reach the 
three components before being interdicted by security officers. 
According to the inspection report, sufficient delay is an essential 
component of a protective strategy to prevent radiological sabotage. As 
a result of the inspection, the licensee agreed to add delay locks to 
doors and relocate security officers to ensure they could interdict 
attackers. 

* NRC found that a number of sites ran weapons-training qualification 
courses in which security officers were not trained in the way they 
would be expected to perform during an attack. For example, sites did 
not train security officers to use backup weapons for when they could 
not use their primary weapons, or to undergo the level of physical 
stress an officer would experience during an attack. At one of the 
sites, NRC also found that the site had lowered the minimum 
qualification score related to training security officers to use their 
weapons, potentially resulting in security officers being less 
qualified in the use of their weapons than what NRC believes is 
necessary. In addition, the licensee did not seek NRC approval for the 
change as mandated by NRC's regulations. However, NRC found that all of 
the security officers who had received the training before the issue 
was observed and corrected had qualified on the use of their weapons at 
the higher score. Furthermore, according to NRC, the agency issued 
amplified guidance to all nuclear power plant sites regarding weapons- 
training qualification courses. 

* During the force-on-force inspection we observed, NRC inspectors 
found that a site had not included the control room, spent fuel pool, 
and the alternative shutdown panel among its targets. NRC required the 
licensee to redevelop its target components for use in the force-on- 
force scenarios. The adequate identification of target components is 
vital to a site's ability to position security officers or direct them 
to locations where they can interpose themselves between the attacker 
and target components. 

* In an inspection initiated after the licensee observed security 
officers who were inattentive at their posts, NRC inspectors found the 
licensee had recorded 19 incidences in which security officers worked 
more hours in a specific time period than allowed by NRC regulations. 
NRC concluded that failure to meet the work-hour limits increased the 
susceptibility of security officers to fatigue and had the potential to 
reduce the effectiveness of the site's protective strategy. According 
to the inspection report, the licensee identified several causes that 
contributed to the problem and took immediate corrective actions. 
According to NRC, the agency verified that the site updated its 
procedures to conform to NRC's work-hour regulations. (At the four 
sites we visited, we reviewed work-hour logs and found that each site 
had generally stayed within security officer work-hour limits.) 

* In a baseline inspection, the licensee was unable to provide 
engineering documents to demonstrate the acceptable minimum safe 
standoff distance from the inner vehicle barrier system, which is 
designed to protect the site from a vehicle bomb. NRC requested that 
the licensee measure the distance between several structures and the 
closest part of the vehicle barrier system. The measurements showed 
that the barrier was too close to at least two structures. As immediate 
corrective and compensatory actions, the licensee installed additional 
vehicle barriers in the area of concern and implemented direct 
observation by a security officer. 

[End of section] 

Appendix III: Comments from the Nuclear Regulatory Commission: 

UNITED STATES: 
NUCLEAR REGULATORY COMMISSION: 
WASHINGTON, D.C. 20555-0001: 

February 23, 2006: 

Mr. James E. Wells, Jr.: 
Director, Natural Resources and Environment: 
U.S. Government Accountability Office: 
441 G Street NW: 
Washington, D.C. 20548: 

Dear Mr. Wells: 

On behalf of the U.S. Nuclear Regulatory Commission (NRC), I am 
responding to your letter by e-mail dated February 7, 2006, requesting 
NRC review and comment on your unclassified, draft report, "Nuclear 
Power Plants: Efforts Made to Upgrade Security, but the Nuclear 
Regulatory Commission's Design Basis Threat Process Should Be Improved" 
(GAO-06-388). I appreciate your providing the NRC the opportunity to 
review this draft report and the willingness of you and your staff to 
maintain a continuing dialogue with the NRC. I also appreciate the time 
and effort that you and your staff have invested in reviewing this 
important topic and the care that you have taken to ensure that your 
report is accurate and constructive. I understand that the U.S. 
Government Accountability Office (GAO) plans to make a number of 
changes to enhance the report's accuracy, clarity, and context. Given 
NBC's current understanding of the report's contents, I am providing 
additional clarifying comments for your consideration on two areas of 
the report. Please note that these comments are the same as those I 
provided to you on January 24, 2006, on the classified version of this 
report, which the NRC previously reviewed. 

First, GAO's draft report suggests that having detailed criteria for 
use during design basis threat (DBT) decision-making regarding 
radiological sabotage at nuclear power plants would increase 
transparency and reduce a potential for the appearance of 
arbitrariness. The Commission rejects any implication of arbitrariness. 
The Commission has been guided by the Atomic Energy Act and its 
regulations and the broad policy considerations that have been found 
pertinent during deliberations on the DBT. The Commission has a long 
history of experience in this area, having first established a DBT for 
nuclear power plants in the late 1970s. While additional delineation of 
relevant considerations might be useful in some circumstances, reasoned 
judgment within this and other areas of the Commission's statutory 
decision-making authority does not require, and in fact could be unduly 
restricted, by detailed prescriptive criteria. Moreover, consistent 
with governing statutes, the Commission utilized an appropriate 
decision-making process by providing for a majority Commission position 
on well-documented staff papers in order for actions to proceed, and 
documenting individual Commissioner views and proposed modifications 
for consideration by other Commissioners. With regard to the revised 
DBT, the report does not reflect the NBC's view that the basis for the 
Commission's policy decisions and direction to the NRC staff are 
sufficiently articulated in the Commission voting record and related 
staff requirements memoranda on the revised DBT. A more comprehensive 
discussion of the Commission's deliberative decision-making process in 
the report would provide important perspective, and the members of the 
NRC staff are available to work with you on a more comprehensive 
description. 

Second, the NRC believes that the report should provide a better 
description of the context for NBC's actions regarding the opportunity 
for industry input and the appearance of industry influence on the 
development of the revised DBT in 2003. The process used for developing 
the revised DBT and obtaining stakeholder input was driven, in large 
part, by the post-9/11 threat environment and the need to enhance 
security at nuclear power plants. The agency made a deliberate decision 
to develop the revised DBT, while simultaneously (in lieu of 
sequentially) seeking input from stakeholders (including the nuclear 
industry). This was a departure from our typical approach, not unlike 
other government actions taken after 9/11, and was intended to advance 
public health and safety and the common defense and security in an 
expedited manner. As noted in my letter of January 24, 2006, the NRC 
has since returned to its normal sequential approach of first 
developing proposed DBT revisions, and then seeking comments on the 
proposed revisions from stakeholders. The NRC requests that your report 
fully explain this issue. 

In addition, the NRC and GAO staffs have discussed potential issues 
related to the draft report that need to be addressed. Also, NRC staff 
believes that the current version of the draft report contains 
Safeguards Information and this information should be removed prior to 
the document being made public. It is my understanding these issues 
will be appropriately resolved. 

Should you have any questions about these comments, please contact 
either Mr. William Dean at (301) 415-1703, or Ms. Melinda Malloy, at 
(301) 415-1785, of my staff. 

Sincerely, 

Signed by: 

Luis A. Reyes: 
Executive Director for Operations: 

[End of section] 

Appendix IV: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Jim Wells, (202) 512-3841 or [Hyperlink, wellsj@gao.gov]: 

Staff Acknowledgments: 

In addition to the individuals named above, Raymond H. Smith, Jr. 
(Assistant Director), Joseph H. Cook, and Michelle K. Treistman made 
key contributions to this report. Also contributing to this report were 
John Cooney, Doreen Feldman, Andrew O'Connell, Judy K. Pagano, Keith A. 
Rhodes, Carol Herrnstadt Shulman, and Barbara Timmerman. 

(360658): 

FOOTNOTES 

[1] Some sites have more than one nuclear power plant. 

[2] The National Commission on Terrorist Attacks Upon the United States 
issued The 9/11 Commission Report on July 22, 2004. 

[3] The DBT applied to nuclear power plants is intended to address the 
threat of radiological sabotage, a deliberate act against a plant that 
could directly or indirectly endanger public health and safety through 
exposure to radiation. NRC has a separate DBT (not the subject of this 
report) for NRC-licensed facilities storing material that could be used 
in a nuclear weapon. 

[4] 10 C.F.R. § 50.13. 

[5] The process of assessing threats to critical infrastructure, such 
as nuclear power plants, and identifying actions to reduce risks is 
often referred to as "risk management." Risk management acknowledges 
that while risk generally cannot be eliminated, enhancing protection 
from known or potential threats can reduce it. Furthermore, because 
security systems cannot protect against all threats, plans for actions 
to be taken if an event occurs that exceeds the capability of a 
security system are also important to reducing risk. 

[6] NEI representatives told us this figure is current as of June 2004 
based on a survey of nuclear power plants. 

[7] For more information on these efforts, see GAO, Nuclear Regulatory 
Commission: Preliminary Observations on Efforts to Improve Security at 
Nuclear Power Plants, GAO-04-1064T (Washington, D.C.: Sept. 14, 2004); 
and Nuclear Regulatory Commission: Oversight of Security at Commercial 
Nuclear Power Plants Needs to Be Strengthened, GAO-03-752 (Washington, 
D.C.: Sept. 4, 2003). 

[8] Safeguards information includes information that is not classified 
as National Security Information or Restricted Data but is considered 
sensitive because it identifies a licensee's security measures. 
Requirements for the protection of safeguards information are detailed 
in 10 C.F.R. § 73.21. 

[9] 10 C.F.R. § 73.1. 

[10] DHS conducts these activities in accordance with a Homeland 
Security Presidential Directive issued by the President on December 17, 
2003 (HSPD-7). For further information on DHS efforts to assess risks 
to critical infrastructure, see GAO, Risk Management: Further 
Refinements Needed to Assess Risks and Prioritize Protective Measures 
at Ports and Other Critical Infrastructure, GAO-06-91 (Washington, 
D.C.: Dec. 15, 2005). 

[11] These semiannual reports were suspended after the terrorist 
attacks of September 11, 2001, while the threat assessment staff worked 
to update the DBT. The threat assessment staff resumed its semiannual 
reports to the commissioners in October 2003. 

[12] Pub. L. No. 109-58, § 651(a)(l), (2005). 

[13] In this report, "terrorist cell" refers only to terrorists who 
participate in an attack, not those who support but do not participate 
in an attack. 

[14] The amount of explosives in a vehicle bomb is expressed in TNT but 
may consist of an equivalent amount of another type of explosive 
material. 

[15] In response to the attacks of September 11, 2001, both NRC and DOE 
undertook reviews of their DBTs. DOE issued its DBT 1 month after NRC, 
in May 2003, and revised its DBT again in October 2004 and most 
recently in November 2005. While NRC required nuclear power plants to 
implement security enhancements in response to its April 2003 DBT by 
October 29, 2004, DOE is not requiring full compliance with its DBT for 
radiological sabotage until October 2006 in order to allow its sites 
adequate time to implement security measures. For further information 
on the DOE DBT, see GAO, Nuclear Security: DOE's Office of the Under 
Secretary for Energy, Science and Environment Needs to Take Prompt, 
Coordinated Action to Meet the New Design Basis Threat, GAO-05-611 
(Washington, D.C.: July 15, 2005); and Nuclear Security: DOE Needs to 
Resolve Significant Issues Before It Fully Meets the New Design Basis 
Threat, GAO-04-623 (Washington, D.C.: Apr. 27, 2004). 

[16] According to NRC, the agency routinely prepares regulatory 
analyses of costs and benefits when establishing regulations and 
implementation guidelines, including those that involve security. 

[17] The NRC staff did recommend some of these weapons for inclusion in 
the DBT for NRC-licensed facilities storing nuclear material that could 
be used to construct a nuclear weapon. 

[18] Four commissioners were serving at the time the DBT was revised, 
with one seat vacant. According to commission procedures, any change to 
the prior DBT required a majority vote, with at least three 
commissioners supporting the change. 

[19] By an order in February 2002, NRC required plants to enhance 
security in the owner-controlled areas. 

[20] The sites had first increased the number of security officers in 
response to the September 11 attacks. Furthermore, an NRC security 
order, issued in February 2002, required sites to have a minimum number 
of security officers stationed in the protected area and immediately 
available to respond to an attack. 

[21] On April 29, 2003, the same day NRC issued the revised DBT, NRC 
issued a publicly available order establishing more stringent 
requirements for security force work-hour controls. 

[22] This NRC requirement for an intrusion detection system at the 
protected area perimeter existed prior to the 2003 revisions to the 
DBT. 

[23] These numbers do not include additional security officers at each 
site who are responsible for security functions such as conducting 
vehicle searches and manning the central and secondary alarm stations. 

[24] NRC officials told us that 11 sites required extensions to the 
deadline for implementing their new security plans but have since 
implemented all of the security measures described in the plans in 
accordance with NRC-approved schedules. A common reason for the 
extensions was the scarcity of bullet-resistant steel, which was in 
high demand in Iraq. This was the case at one site we visited. Another 
site we visited required an extension due, in part, to a limited supply 
of cement for the vehicle barrier system. 

[25] The current force-on-force inspection program has been in place 
since November 2004. For further information on NRC's efforts and our 
recommendations, see GAO-04-1064T and GAO-03-752. 

[26] Controllers are individuals provided by the licensee who observe 
each security officer and attacker to ensure the safety and effective 
conduct of the exercise. They make decisions about aspects of the 
exercise that are necessarily artificial, such as the use of explosives 
or any other device that could cause actual damage to a site or its 
security equipment. Controllers are also responsible for alerting 
security officers or attackers about events that are part of an 
exercise scenario but not actually simulated, such as an explosion or 
loss of power. 

[27] In addition to triennial force-on-force inspections, NRC requires 
licensees to conduct and document additional security force training 
drills. 

[28] The fourth commissioner was no longer serving on the commission at 
the time of our review. 

[29] Pub. L. No. 94-409 (1976), 5 U.S.C. § 552b. 

[30] Results from nonprobability samples cannot be used to make 
inferences about a population, because in a nonprobability sample some 
elements of the population being studied have no chance or an unknown 
chance of being selected as part of the sample. 

[31] In accordance with its inspection manual, NRC has 45 days to 
report the results of a force-on-force inspection. Thus, while NRC had 
completed 16 force-on-force inspections at the time of our review, only 
9 reports were available to us to review for this report. 

[32] NRC may complete a baseline inspection at one site over several 
visits to the site and produce a report for each visit. Because of 
this, the inspection scope of the 18 reports we reviewed varied. 

[33] We did not discuss the details of the DBT with representatives of 
the Project on Government Oversight because such information is 
safeguards information. 

[34] We did not verify the corrective actions taken by the licensees. 

GAO's Mission: 

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading. 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548: 

To order by Phone: 

Voice: (202) 512-6000: 

TDD: (202) 512-2537: 

Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Public Affairs: 

Jeff Nelligan, managing director, 

NelliganJ@gao.gov 

(202) 512-4800 

U.S. Government Accountability Office, 

441 G Street NW, Room 7149 

Washington, D.C. 20548: