skip navigation links 
 
 Search Options 
Index | Site Map | FAQ | Facility Info | Reading Rm | New | Help | Glossary | Contact Us blue spacer  
secondary page banner Return to NRC Home Page

RULEMAKING ISSUE
(Affirmation)

SECY-07-0131

August 7, 2007

For: The Commissioners
From: Karen D. Cyr
General Counsel       /RA/
Subject:

FINAL RULE - 10 CFR PART 73 "SAFEGUARDS INFORMATION PROTECTION REQUIREMENTS" (RIN 3150 - AH57)

PURPOSE:

To obtain Commission approval to publish a final rule that amends the Safeguards Information (SGI) protection requirements in 10 CFR Part 73 and that makes conforming changes to other provisions of the regulations. As the Commission has directed, the rule utilizes the flexibility of Section 147 of the Atomic Energy Act of 1954, as amended (AEA), including amendments in the Energy Policy Act of 2005, regarding the protection of SGI. In addition, the rule reflects the practices of the Commission in various orders and advisories issued since September 11, 2001.

SUMMARY:

The final rule contains some substantive changes from the revised proposed rule, published on October 31, 2006 (71 FR 64004), but the most important features of the revised proposed rule have been retained. Some changes were made in response to public comments, but others were made on the initiative of the NRC staff (staff). Of the substantive changes made to the revised proposed rule, the Staff considers the following two to be among the more important. First, the Staff recommends deletion of the ten-year SGI decontrol review requirement contained in §§ 73.22(f) and 73.23(h) because the benefits of the review are outweighed by the costs. Second, additional procedures for challenging adverse trustworthiness and reliability determinations in adjudicatory proceedings have been added in §§ 2.336(f)(1)(iii), 2.705(c)(3)(iii), 2.709(f)(1)(iii), and 2.1010(b)(6)(i)(C) to provide the essential rights of § 73.57(e)(1)-(2) to challenge information obtained for a background check other than the criminal history records check.

BACKGROUND:

In a Federal Register notice dated February 11, 2005 (70 FR 7196), the Commission proposed a rule to amend the SGI protection requirements in 10 CFR Part 73 and other provisions of the regulations. After receiving, analyzing and responding to comments on the proposed rule and making other changes directed by the Commission, the Office of the General Counsel (OGC) transmitted to the Commission on July 5, 2005, SECY-05-0119, "Final Rule - 10 CFR Part 73, Safeguards Information Protection Requirements" (RIN 3150 - AH57). In SRM-05-0119, the Commission directed OGC to revise and re-publish the proposed rule to reflect, among other changes, the NRC's expanded authority in Section 652 of the Energy Policy Act of 2005 forrequiring fingerprinting of individuals prior to granting access to SGI. In addition, the Commission directed that the rule text be revised to include protection of information associated with the transportation of radioactive materials in quantities of concern (RAMQC).

The revised proposed rule was published in the Federal Register on October 31, 2006 (71 FR 64004), and requested comment on the changes made to the first proposed rule. Because of the prior opportunity for public comment on the original proposed rule, the Commission requested that comments on the revised proposed rule focus on the changes and additions to the original proposed rule and not on areas discussed in previous comments. In addition, the Commission solicited specific public comment (71 FR 64051) on the appropriateness of the exemptions in the revised proposed rule from the requirement for a background check for access to SGI.

DISCUSSION OF COMMENTS AND RESPONSES:

Overview of Comments

The Commission received ten comment letters on the revised proposed rule, most from industry or industry groups, and two from Agreement States. One of the comment letters was submitted in June 2007, well after the January 2007 deadline for comments, by the Agreement State of Nevada. The letter from Nevada is one of two letters commenting on § 73.59, although neither comment letter referred to the request for specific comment on § 73.59 noted above.

The attached draft Federal Register notice contains responses to these comments and changes to rule text in response to comments or otherwise identified in the development of the final rule. Significant comments and changes to the rule text are summarized below.

Many of the significant comments concern the ten-year decontrol review requirement of proposed 10 CFR 73.22(h) and 73.23(h). Other comments relate to the procedures in NRC adjudicatory proceedings for the designation, marking and handling of SGI, and access to SGI. Comments relating to other sections in Part 73 are noted later in this document. Because of the Staff's extensive analysis of the impacts that could occur as a result of implementing the ten-year SGI decontrol requirements, the staff is summarizing below its response to the comments on this issue.

Ten-Year SGI Decontrol Review

A major topic of concern for several commenters is the ten-year SGI decontrol review requirement of proposed 10 CFR 73.22(h) and 73.23(h). This requirement was inserted into the revised proposed rule pursuant to direction from the Commission in item 4 of SRM-06-0025. Under these provisions, holders of SGI would be required to perform a review every ten years of SGI-designated documents in their possession that are ten years or older, and that are in current use or removed from storage. All of the comments received on this requirement urge that it be removed from the rule on the basis that the costs of performing the review would not be justified by the benefits. The Staff agrees with the commenters that the ten-year SGI decontrol review requirement should not be included in the final rule.

Several tasks would be involved in performing the ten-year SGI decontrol review. Although not explicitly required by the proposed requirement, the cataloguing of all SGI documents in a holder's inventory would be necessary as a practical matter so that SGI documents ten years or older and in current use could be identified. Other tasks would include reviewing these identified documents for possible decontrol every 10 years, and as a best practice, communicating decontrol determinations to other holders of the decontrolled documents.

The staff believes that the review requirement should be removed because the benefits of the review would be outweighed by the costs. The benefits would not be substantial because both the current rules in § 73.21(i) and the revised proposed rule in §§ 73.22(h) and 73.23(h) require, independent of any ten-year review, the removal of SGI designations for documents no longer containing SGI. Thus, a person using an SGI-designated document that no longer meets the definition of SGI would be required to remove the designation. This requirement applies to SGI documents of any age.

Also, relatively few SGI-designated documents would be decontrolled by the ten-year decontrol review because, of the many SGI documents in the possession of licensees and applicants, there are likely very few that are 10 years or older and still in current use, and many of these would still contain SGI. Furthermore, documents no longer controlled as SGI might still need to be controlled if they contain other sensitive information. Even if a document has been entirely decontrolled, however, private entities such as NRC licensees are not subject to the Freedom of Information Act (FOIA), and so there is generally no obligation for private entities to make their documents public. Maybe about half of SGI documents in the possession of licensees are likely in the possession of the NRC, and the NRC is subject to FOIA. Therefore, SGI-designated documents that have been decontrolled by licensees and are also in the NRC's possession might be made public on ADAMS, but only if the licensees inform the NRC of the decontrol determination. Licensees may so inform the NRC as a best practice, but there is no explicit requirement in the rules to do so.

In addition, the total estimated costs for all entities would amount to $2.5 million over the period 2008-2018. (1) For power reactors as of the 2018 review, the cost per decontrolled document is estimated to be about $750 and the cost per document possibly made public by the NRC is estimated to be about $1500. An additional reason to remove the requirement is that document cataloguing, although required as a practical matter by the 10-year review requirement, is not required for documents containing Classified National Security Information.

SGI Procedures in Adjudicatory Proceedings

Comments on the procedures used for SGI in adjudicatory proceedings can be grouped broadly into the following three areas: burdens on parties to NRC adjudications, SGI designation and access determinations, and sanctions for violating SGI protective orders in adjudications.

Comments on burdens to parties to NRC adjudications raise the following issues:

  1. Whether intervenors should have to designate the SGI they generate or whether the Staff should do so;
  2. Whether intervenors should potentially be subject to criminal or civil sanctions for violations of requirements for the protection of SGI;
  3. Whether parties other than the Staff should be allowed to submit SGI-designated documents to the Staff for possible decontrol or partial decontrol; and
  4. Whether the rule should contain explicit procedures relating to the potential filing of SGI in appeals of Commission decisions to Federal courts.

The following issues are associated with comments on SGI designation and access determinations in adjudications:

  1. Whether procedures for making "need to know" determinations could result in potentially biased determinations;
  2. Whether procedures for challenging "need to know" determinations would unfairly require intervenors to reveal confidential information;
  3. Whether an officer, other than the presiding officer of a proceeding, must always review final adverse trustworthiness and reliability determinations of the NRC Office of Administration;
  4. Whether presiding officers should be permitted to review whether information that has been designated as SGI meets the definition of SGI;
  5. Whether the revised proposed rule's abuse of discretion standard for presiding officer review of adverse trustworthiness and reliability determinations is improper; and
  6. Whether more than fifteen days should be given to a presiding officer for review of adverse trustworthiness and reliability determinations.

Comments on the provisions in Part 2 that would apply criminal and civil sanctions for violations of SGI protective orders in adjudications:

These comments present the issue of whether the language of these provisions would cover situations unrelated to the protection of SGI from unauthorized disclosure.

Detailed responses to the comments on the above issues and topics are set forth in the attached draft Federal Register notice, but the Staff deems the following issues to be of particular importance.

Presiding Officer Review of SGI Designations

A commenter raised the issue of whether presiding officers in NRC adjudicatory proceedings are qualified to determine whether information designated as SGI meets the definition of SGI. A presiding officer might be called upon to make such a determination in a discovery dispute. The revised proposed rule did not speak, implicitly or explicitly, to the issue of a presiding officer's authority to determine whether information designated as SGI meets the definition of SGI. As stated in the response contained in the attached Federal Register notice, presiding officers can make such determinations. If the presiding officer believes it beneficial, the presiding officer can request the Commission to appoint a special adjudicatory employee to assist the presiding officer. In support of this position, the response cites to the Commission's direction, in a similar context, in Private Fuel Storage, L.L.C. (Independent Spent Fuel Storage Installation), CLI-05-22, 62 NRC 542, 545 (2005).

"Need to know" Determinations for Access to SGI

A commenter believes that the process in the revised proposed rule for making "need to know" determinations in the adjudicatory context of discovery is flawed, and could prejudice intervenors, because the initial determinations are made by other parties, who are "adverse" to intervenors. The response in the Federal Register notice maintains the process in the revised proposed rule by noting that presiding officer review is provided for adverse "need to know" determinations. This review is a check on any potential bias involved in the initial determination. The response also notes that this process is similar to the discovery process for the assertion of privileges, which involves an initial privilege determination by the party seeking to withhold the information that can then be challenged by a motion to compel.

The same commenter also finds fault with the procedures for challenging "need to know" determinations, which the commenter believes will prejudice intervenors by requiring them to reveal confidential information, such as their litigation strategy and attorney work-product. The response in the Federal Register notice notes that it is likely that "need to know" determinations can be made on the face of contentions alone. Also, if additional confidential information has to be divulged, no more information would likely need to be divulged than is divulged in challenges to assertions of qualified privileges, the consideration of which involve a party's need for the privileged information.

Comments on topics other than the ten-year SGI decontrol review and Part 2

Topics in other comments include:

  1. Designation of information in materials licenses as SGI;
  2. Interaction of the regulations with the regulations of other agencies;
  3. Implementation period for the rule;
  4. The meaning of the terms "safe havens" and "control and accounting," which were not separately defined in the revised proposed rule;
  5. Requiring a licensee with two facilities on a single site to protect certain information as SGI and other information as SGI-M;
  6. The SGI-M requirements for the shipment of RAMQC;
  7. Linkage of the term "engineering and safety analyses" to security;
  8. Potential prohibition of communications during the shipment of radioactive materials;
  9. Use by the Commission of "other means" as approved by the Commission in lieu of a background check for trustworthiness and reliability determinations;
  10. Marking and storage of SGI;
  11. Scope of the exemption in § 73.59 from the background check requirement for representatives designated by a Governor;
  12. Accuracy of the regulatory and backfit analyses in reflecting the costs to licensees of implementing the rule; and
  13. Quantitative information in the regulatory and backfit analyses to justify the benefits provided by the rule.

Summary of Final Rule Changes

Changes made in response to comments or otherwise identified in the development of the final rule include:

  1. The ten-year SGI decontrol review requirement contained in the second and third sentences of 10 CFR 73.22(h) and 73.23(h) will be removed.

  2. Provisions for SGI in adjudications that were contained in 10 CFR 2.705(c)(2)-(7) in the revised proposed rule were misnumbered. This misnumbering inadvertently removed the § 2.705(c)(2) that is in the current rules. Section 2.705(c)(2) in the current rules will be retained, and the SGI provisions will be moved to § 2.705(c)(3)-(8).

  3. Sections 2.336(f)(5), 2.705(c)(7), 2.709(f)(5) and 2.1010(b)(6)(v) will be modified to clarify that the only violations of a presiding officer's order that will be subject to civil penalties under § 2.205 are violations of the provisions for the protection of SGI from unauthorized disclosure. The change is being made because a commenter pointed out that the language in the revised proposed rule, which applies to violations of presiding officer orders "pertaining to the disclosure of Safeguards Information," could cover situations such as an order requiring disclosure of SGI to other parties.

  4. In § 2.336(f) the term "presiding officer" is used throughout, but there may be instances in which adjudicatory decisions related to SGI need to be made prior to the designation of a presiding officer. Such an instance includes an individual seeking SGI in order to proffer a contention, and it makes sense to resolve disputes in these instances as quickly as possible. To account for this situation, a new § 2.336(f)(7) will be added.

  5. Additional procedures have been added in § 2.336(f)(1)(iii) for adjudicatory proceedings in order to provide the essential rights of § 73.57(e)(1)-(2) for elements of a background check other than the criminal history records check. These procedures must be followed before a final adverse determination on trustworthiness and reliability by the Office of Administration. Conforming changes have also been made to §§ 2.705(c)(3)(iii), 2.709(f)(1)(iii), and 2.1010(b)(6)(i)(C).

  6. References will be added in new §§ 2.704(f) and 2.1018(h) to clarify that SGI discovery procedures cover disclosures under § 2.704 and discovery under § 2.1018.

  7. To clarify which individuals can challenge final adverse trustworthiness and reliability determinations, "[p]articipants, potential witnesses, and attorneys" will be replaced with "[i]ndividuals seeking access to Safeguards Information to participate in an NRC adjudication" in §§ 2.336(f)(1)(iv), 2.705(c)(3)(iv), 2.709(f)(1)(iv), and 2.1010(b)(6)(i)(D). A similar change will also be made in § 73.57(e)(3). This change avoids the term "participant," which is potentially confusing because it was not defined in the rule, (2) and conforms with language used in the rule to identify those who can challenge adverse "need to know" determinations.

  8. To clarify the scope of §§ 2.336(f)(3), 2.705(c)(5), and 2.709(f)(3), the word "participant" is being replaced in the final rule by "anyone."

  9. To clarify the scope of the presiding officer's authority to include in an order any protective terms and conditions as may be necessary and appropriate to limit unauthorized disclosure of SGI, § 2.336(f)(2) has been rewritten in the final rule so as not to tie that authority to certain specified entities. Tying this authority to specified entities might create confusion. The list of specified entities in proposed § 2.336(f)(2), for example, was incomplete. Conforming changes have also been made to §§ 2.705(c)(4), 2.709(f)(2), and 2.1010(b)(6)(ii).

  10. The term "Chairman of the Atomic Safety and Licensing Board Panel," which appeared several times in the revised proposed rule, will be changed to "Chief Administrative Judge" in the final rule to reflect the usage of 10 CFR 1.15.

  11. A definition of "quantities of concern" is added in 10 CFR 30.4, and other terms (e.g., "safe haven" and "control and accounting procedures") are explained in the final rule, Statements of Consideration.

  12. Clarifications have been made in §§ 73.22(h) and 73.23(h), covering the options for decontrolling SGI.

  13. The scope of the rule as set forth in § 73.21 is broadened to include "certificate holders."

  14. The rule specifies in §§ 73.22 and 73.23 that the specific requirements for the protection of SGI apply to SGI "in the hands of any person."

  15. The references in §§ 73.22(b)(4) and 73.23(b)(4) to persons specified in § 73.59 are deleted because § 73.59 does not exempt the specified categories of persons from the need to know provisions of the rule.

  16. The effective date of the rule is being changed from 90 days from the date of publication in the Federal Register to 120 days from that date in order to allow licensees sufficient time to implement requirements in the rule not reflected in orders.

Other corrections and clarifications of a minor nature and not specifically noted above were also made to the rule text.

Future Rulemaking on NRC-Approved Reviewing Officials

During the development of this rule, a number of SGI-related issues have arisen in connection with SGI fingerprinting orders, through submission of public comments on the proposed SGI rule, or through internal Staff or OGC review. These issues either are beyond the scope of this rulemaking or, if they are incorporated into this rulemaking, would require re-noticing. These issues, therefore, are not addressed in this draft final rule. Some of these issues relate to the requirement, imposed in numerous fingerprinting orders issued by the staff, that certain licensees who are required to fingerprint individuals before granting them access to SGI must nominate for NRC approval a "Reviewing Official" who requires access to SGI. Upon NRC approval of that individual after reviewing the results of the FBI criminal history records check, the individual will be designated as the licensee's official who is authorized to make SGI access determinations for all other licensee employees, contractors, agents, or consultants.

In addition to issues associated with the Reviewing Official, other SGI issues addressed in NRC orders include relieving individuals who already have satisfied the background check requirement (including Federal fingerprinting as part of the criminal history records check) by documented proof of alternative means, such as having an active Federal security clearance or having undergone a background check (with a Federal criminal history records check) within the past five years. Other issues involve access to SGI by foreign nationals not already covered by the exemptions in § 73.59 for certain categories of foreign nationals, whose criminal history records in FBI data bases likely would not produce any information, prohibitions on removing documentary SGI from the United States, and providing relief by rule from the background check requirement for a limited number of additional categories of individuals beyond those in 10 CFR 73.59. Still other issues relate to whether the scope of SGI as defined in the draft final rule is sufficient to include the aircraft characteristics that the Commission will require new power reactor designers to use in performing an aircraft impact assessment, and whether the "vendors" who will perform those assessments are within the scope of Part 73 as revised by this draft final rule. In the absence of an additional rulemaking, these issues will have to continue to be addressed by orders. To avoid having to issue SGI-related orders indefinitely, in the near future OGC and the staff will propose for Commission consideration a rulemaking plan identifying the SGI-related issues that need to be addressed and codified in NRC regulations (likely in §§ 73.21, 73.22 and 73.23).

COORDINATION:

The Office of the Chief Financial Officer has reviewed this Commission Paper for resource implications and has no objection. The EDO has reviewed this Commission paper and has no objection.

RESOURCES:

The final rule will be implemented in fiscal year 2008, and resources, such as development and review of guidance, inspection, and performance of background checks, are included in the current budget. The estimated NRC resources associated with the final rule are approximately two full-time equivalent employees (FTEs). These resources will come principally from the Office of Nuclear Security and Incident Response.

RECOMMENDATION:

  1. OGC recommends that the Commission approve the attached final rule (Enclosure 1) for publication in the Federal Register. The rule would become effective 120 days from the date of publication.

  2. To satisfy the requirement of the Regulatory Flexibility Act, 5 U.S.C. 605(b), the Commission must certify that this rule, if promulgated, will not have significant impact on a substantial number of small entities. This certification is included in the attached Federal Register notice.

  3. Note:

    1. The Chief Counsel for Advocacy of the Small Business Administration will be informed of the certification and the reasons for it, as required by the Regulatory Flexibility Act, 5 U.S.C. 605(b);
    2. A final Regulatory Analysis has been prepared for this rulemaking (Enclosure 2);
    3. A final Environmental Assessment has been prepared for this rulemaking (Enclosure 3);
    4. Copies of the Federal Register notice of final rulemaking will be distributed to all affected Commission licensees, Agreement States, and other States. The notice will be sent to other interested persons upon request;
    5. This paper should be made publicly available after the Commission issues its Staff Requirements Memorandum.
    6. The Enforcement Policy and inspection procedures will be reviewed and revised, if necessary;
    7. The staff has determined that this action is not a "major rule," as defined by the Congressional Review Act, 5 U.S.C. 804(2), and has confirmed this determination with the OMB. The appropriate Congressional and Government Accountability Office contacts will be informed;
    8. The appropriate Congressional committees will be informed;
    9. A press release will be issued by the Office of Public Affairs when the final rulemaking is filed with the Office of the Federal Register; and
    10. The rule contains changes in information collection requirements that will be submitted to OMB for review and approval before the final rule is forwarded to the Federal Register for publication. OMB did not undertake a review of the information collection requirements contained in the revised proposed rule, and, accordingly, publication of the final rule will be on hold until the NRC receives OMB approval of the information collection requirements contained in the final rule.
 

/RA/

Karen D. Cyr
General Counsel

Enclosures:
  1. Final Rule Federal Register notice PDF Icon
  2. Regulatory Analysis PDF Icon
  3. Environmental Assessment PDF Icon

CONTACTS:

Marjorie U. Rothschild, OGC
301-415-1633

 

Michael Spencer, OGC
301-415-4073


1 Costs are in 2007 dollars assuming a 7 percent Discount Rate for the period 2008-2018. The overwhelming majority of these costs are due to the power reactors who simply possess many more SGI documents than other types of facilities. Information from the Nuclear Energy Institute (NEI) suggests that there was an average of about 2300 SGI documents per power reactor site in 2005, with about 230 documents being produced each year.

2 The Staff notes that the term "participant" is defined in the final E-filing Rule that was submitted for Commission consideration in SECY-07-0109.



Privacy Policy | Site Disclaimer
Thursday, March 20, 2008