Response to the 2022 GAO Audit and Investigation on NRC and Agreement State Materials Licensing: Questions and Answers
What is a radioactive source?
A radioactive source contains a particular type of radionuclide (such as americium-241) that is encased in a capsule designed to prevent escape of the material. The capsules used in industrial and medical applications are made of high-quality metal and must be built to strict national standards. The NRC and/or an Agreement State (see next question) approve the design and the use of any radioactive source. The sources will vary in size, but a majority are no larger than an adult's fingernail.
What is an Agreement State?
Congress authorized the NRC to relinquish its authority to a State to regulate certain radioactive materials. Agreement States may regulate source and small quantities of special nuclear materials at academic, medical and industrial facilities within their borders. The NRC and State enter into an "Agreement" giving the State authority to regulate under its own legislation and regulations. Agreement States must maintain a regulatory program that is adequate to protect public health and safety and compatible with NRC requirements. The compatibility requirements are set by Commission policy.
What type of sources did GAO order, and what are radioactive materials used for?
GAO was successful in ordering, but did not receive, radioactive sources from two domestic vendors using counterfeit licenses. GAO was unsuccessful in ordering a third source because the license was identified as fraudulent. Radioactive materials are commonly used throughout the U.S. for medical and industrial purposes such as treating cancer, sterilizing medical instruments, and detecting flaws in metal welds. Among the materials most commonly used for these applications are americium-241/beryllium, cesium-137, cobalt-60, and iridium-192.
How much does it cost to get a radioactive materials license?
License fees are listed in 10 CFR 170.31 and vary depending on the license type. For example, an application for a well logging license from the NRC requires a $4,800 fee. Once licensed, the licensee is required to pay an annual fee to cover licensing reviews by NRC staff. Agreement States also charge fees to review an application for a radioactive material license and to maintain the license. Agreement State fees vary from state to state.
The NRC maintains an oversight responsibility to ensure the Agreement States maintain an adequate and compatible program. The NRC's oversight program is called the Integrated Materials Performance Evaluation Program, or IMPEP. Congress also authorizes the NRC to reassert its authority, if needed.
The NRC is the regulatory authority in non-Agreement States and over nearly all federal agencies that use radioactive materials.
What does it mean, when the terms Category 1, 2, 3, 4 and 5 sources are used?
Categories 1 through 5 are part of a classification system developed by the International Atomic Energy Agency. This system provides a relative ranking of hazards while taking into account how the source could be used to cause harm (see next question) This system ranges such that Category 1 sources have the most harmful effects on a human in a short period of time down to Category 5 sources that are unlikely to cause effects. The NRC security requirements are considerably more stringent for Category 1 and 2 quantities of radioactive material.
What is the potential safety and security concern with Category 1, Category 2 and Category 3 sources?
A Category 1 source would likely cause death or permanent injury to someone who remained in contact with it for more than a few minutes.
A Category 2 source could cause death or permanent injury to someone who remained in contact with it (e.g., in a shirt or pant pocket) for a period of hours to days.
For death or permanent injury to happen with a Category 3 source, the individual would have to be in contact with it (e.g., in their pocket) for a period of days to weeks. Death is unlikely from exposure to a Category 3 source. An individual will begin to have physical effects (e.g., ulcerations, reddening of skin, etc.) and likely seek medical help, which would limit further injury and prevent death.
Exposure to a Category 3 source for days to weeks could lead to permanent injury, e.g., loss of fingers, hand, localized tissue or muscle. It is important to point out that the severe health effects mentioned above can be significantly limited, or even prevented. Simple practices such as limiting time near the source (e.g., hours versus days), increasing distance from the material (e.g., contact versus a few feet away), and adding shielding (e.g., metal container, bricks) between the individual and the material will minimize exposure.
Why does the NRC only require security for Category 1 and 2 sources; shouldn't all radioactive sources be secured?
All radioactive material is subject to safety and security requirements, not just Categories 1 and 2. For over 50 years, the NRC and Agreement States have had a regulatory framework that ensures the safe and secure control and management of radioactive material. With this framework in place, there is a low possibility of harm to workers and the public, and the benefits from its use will outweigh any risks.
Radioactive material used in medical, academic, and industrial applications is subject to the requirements of 10 CFR Parts 20 and 30. Depending on the type of license, the specific requirements of Parts 31, 32, 33, 34, 35, 36 or 39 may also apply. It is common for regulators and stakeholders to refer to these as safety regulations. However, this doesn't capture the full breadth of these requirements. They address control and management including security of material in use, storage and transport; qualifications for individuals with control over the material; material accounting; reporting of events; and reporting of loss or theft of materials.
After the events of September 11, 2001, national and international regulators agreed that certain radioactive materials in certain quantities warranted additional security measures beyond those already in place. Given the existing threat and consequences from malicious use, we added to Part 20, Part 30, and application-specific requirements. The NRC and Agreement States required additional security for Category 1 and 2 materials, which is currently included in NRC regulations under Part 37 and Agreement State requirements.
The NRC and Agreement State regulatory framework for the safety and security of all radioactive material is consistent with standards and recommendations used globally.
Would the National Source Tracking System (NSTS) have identified the GAO's efforts to obtain these sources?
No. The NSTS is intended to account for the manufacture, transfer, receipt, and disposal of radioactive sources at the Category 1 and Category 2 levels. Category 1 and Category 2 sources are the most harmful. The sources that were the subject of the GAO operation—those contained in well logging devices—are Category 3 sources. That means they are below the activity levels of sources that are tracked by the NSTS.
Who is notified if a Region or an Agreement State suspects an illegitimate applicant?
The procedure to handle instances when a license reviewer or inspector suspects an illegitimate applicant requires notification of the Office of Nuclear Material Safety and Safeguards (NMSS) and the Office of Nuclear Security and Incident Response (NSIR). The information may be forwarded to the Federal Bureau of Investigation (FBI) for further review. Suspected cases in Agreement States are forwarded to NMSS and NSIR.
What's the significance if GAO obtained Category 3 material in an amount that could be aggregated to a Category 2 quantity of radioactive material?
The concern with Category 1 or Category 2 quantities is due to their potential to cause serious harm if exposed to them. Because of these concerns, the NRC and Agreement States have additional security measures in place for Category 1 and Category 2 quantities of materials.
Why does the NRC allow paper licenses when they're so easy to alter?
In 2008 after the earlier GAO investigation, the NRC carefully reviewed alternatives to paper licenses. We determined it would be impractical and cost prohibitive to transition the 20,000 paper licenses for radioactive material across the NRC and 37 Agreement States within the United States.
However, the NRC and Agreement States apply a graded approach to transfer of material. For Category 1 and 2 quantities of radioactive materials, transfers between licensees are not permitted using a paper license. For Category 1 and 2 quantities of radioactive materials, the licensee sending the material first has to verify with the regulator or with the NRC's License Verification System (LVS) that the licensee receiving the material is authorized to accept it.
Through these controls, the regulator would quickly identify any license alterations and the transfer would not be approved. Category 1 and 2 radioactive materials account for about 11,000 transfers each year.
The NRC is currently evaluating implementing the same license verification controls imposed on transfers of Category 1 and 2 quantities of radioactive materials for transfers of Category 3 quantities.
How do we know there aren't already people collecting sources for a dirty bomb?
The NRC monitors intelligence information to keep abreast of foreign and domestic events and the capabilities of potential adversaries. We use this information, and other sources, to determine the physical protection requirements of our regulations.
NRC staff routinely interacts with the intelligence and law enforcement communities on intelligence and threat matters. For example, NRC maintains contact with the FBI, U.S. Department of Energy, Central Intelligence Agency, Department of Homeland Security, U.S. Customs and Boarder Protection, the Defense Intelligence Agency, Department of Defense, and other agencies concerned with terrorism. NRC staff provides security threat information to licensed nuclear facilities and materials users.
Did the GAO break any laws to conduct this investigation?
No. GAO has legal authority to conduct investigations as part of its mission to help improve the performance and ensure the accountability of the Federal government. If an applicant took actions to obtain a license under false pretenses or for malevolent purposes, that would violate the law. In such a case, the current pre-licensing guidance includes steps to notify the NRC and quickly engage the appropriate law-enforcement agency. In addition, the applicant would be subject to State and/or Federal investigation and enforcement.
Why didn't the changes you made after previous GAO investigations prevent this occurrence?
The NRC and Agreement States put in place a significant number of changes designed to prevent illegitimate companies from obtaining Category 1 and 2 sources. The GAO investigation did not target either a Category 1 or 2 quantity of material because they agree the controls put in place since 2007 are effective.
Unlike previous operations that were focused on obtaining a legitimate license from a regulator, GAO did not set up or rent storefronts or other physical locations. However, the GAO investigation did highlight areas where the NRC is considering additional enhancements. That evaluation is ongoing.
What security enhancements have NRC and the Agreement States implemented since the previous GAO investigations?
The NRC put in place strict new security requirements via Part 37 (Agreement States via compatible requirements) to enhance security for Category 1 and 2 materials. Key requirements of the security program for Category 1 and Category 2 materials include:
- Background checks, including fingerprinting to help ensure that individuals with unescorted access are trustworthy and reliable.
- Controlling personnel access to areas where radioactive materials in quantities of concern are stored and used. Access must be limited to individuals who require it and are deemed trustworthy and reliable, based on a background and criminal history check.
- Documented security programs that are designed with defense in depth to detect, assess, and respond to actual or attempted unauthorized access.
- Coordination and response planning between the licensee and local law enforcement agencies for its jurisdiction.
- Coordination and tracking of radioactive material shipments.
- Additional security barriers to prevent theft of portable devices.
- In addition to ensuring physical security, the NRC maintains the NSTS to track and account for, from cradle to grave, all the radioactive sources that warrant the highest level of security and control.
- The NRC also requires verification with the regulator that the receiver is authorized to possess the materials and quantities being transferred. The NRC maintains LVS to allow a licensee to conduct this verification with the regulator securely through an on-line system. (The NSTS and Web-Based Licensing systems were integrated to allow for combined license verification, i.e., a check of both the license validity and a check of the NSTS inventory).
Additionally, the pre-licensing guidance for screening license applicants was revised to provide greater assurance that the radioactive material would be used as intended. It was revised to determine the legitimate use of licensed material and includes the following features:
- "Unknown" applicants are subject to pre-licensing site visits.
- Licensees that request an increase in possession limits (greater than Category 2) are also subject to a site visit.
- All new applicants are subject to screening to verify their legitimacy.
- Personnel that need to access risk-significant licensed material (e.g., greater than Category 2) are subject to a security background check (including fingerprinting).
- Additional guidance is included on procedures for screening and clearer criteria for site visits and further checks.
NRC and Agreement States will not authorize receipt of greater than Category 2 quantities of material until confirmation that the licensee/applicant is prepared to implement the security requirements of Part 37 or the Agreement State’s requirements.
What is the NRC planning to do in response to the 2022 GAO recommendations?
After the NRC learned of the GAO investigation in March 2022, the NRC issued generic communications to remind licensees to ensure, before transferring any radioactive material, that license verification meets the requirements set forth in NRC regulations or Agreement State requirements. The NRC provided generic communications to Agreement States for their information and for distribution to their licensees as appropriate.
The NRC is currently evaluating implementing the same license verification controls imposed on transfers of Category 1 and 2 quantities of radioactive materials for transfers of Category 3 quantities.