Sting Reveals Security Gap At Nuclear Agency

The Washington Post reports:

Undercover congressional investigators posing as West Virginia businessmen obtained a license with almost no scrutiny from the Nuclear Regulatory Commission that enabled them to buy enough radioactive material from U.S. suppliers to build a "dirty bomb," a new government report says.

The investigators obtained the license within 28 days from officials at the NRC, the federal agency that in addition to regulating nuclear power plants oversees radioactive materials used in health care and industry, the report by the Government Accountability Office says. NRC officials approved the request with a minimal background check that included no face-to-face interview or visit to the purported company to ensure it existed and complied with safety rules, the report says.

Using a post-office box at Mail Boxes Etc., a telephone and a fax machine, the undercover investigators from the GAO obtained the license "without ever leaving their desks," the report says.

After counterfeiting copies of the license, the GAO undercover agents ordered portable moisture density gauges, which contain radioactive americium-241 and cesium-137 and are commonly used at construction sites to analyze the properties of soil, water and pavement. The investigators ordered 45 gauges -- enough to build a bomb with enough radioactive material to qualify as a level-3 threat on the International Atomic Energy Agency's scale of 1 to 5, with 1 being the most hazardous.

The GAO investigators never took possession of the radioactive material, in part because they lacked the means to handle it safely. But the report notes that, armed with an arsenal of phony licenses, they could have secured contracts to buy much more than they did -- enabling them to make an even more lethal bomb.

"We altered the license so that it appeared our bogus company could purchase an unrestricted quantity" of radioactive material, the report says. A dirty bomb is designed to use conventional explosives to cause immediate injury to people nearby but also to cause a long-lasting threat by contaminating a wider area with radioactive material.

The GAO undertook the sting operation at the request of Sen. Norm Coleman (R-Minn.), the top minority member of the Senate permanent subcommittee on investigations, which since 2003 has been examining security gaps at the NRC and other federal agencies that could leave the country vulnerable to biological or nuclear attack. The report is to be the subject of hearings today before the subcommittee .

The GAO study is the latest of several government reports following the Sept. 11, 2001, terrorist attacks to warn of serious security gaps in NRC licensing procedures. A year ago, undercover GAO officials successfully bought enough radioactive material abroad to make two dirty bombs and smuggled them into the United States at two points, one on the Canadian border and one on the border with Mexico.

"It was as easy to get his material as a DVD at Netflix," Coleman said of the most recent investigation. "If al-Qaeda had set up a phony corporation in the U.S., they could have gathered enough material to make a dirty bomb. The problem is that the NRC is still operating on a pre-9/11 mentality. It boggles my mind that the NRC doesn't readily understand the threat we face."

NRC commissioner Edward McGaffigan Jr. said in an interview yesterday that the agency, while concerned about any security weakness, has had to allocate finite resources to what it thinks are the biggest potential threats to public safety. He said terrorists have looked for relatively simple ways to cause massive death and damage. Devices such as the moisture gauges, he said, pose a relatively low-level risk because they require a vast amount of work to fashion into a dangerous weapon.

"My sole concern, our sole concern, has been the safety of the American people," he said.

After the GAO presented the NRC with the results of its undercover operation, NRC officials on June 1 ordered an immediate, temporary halt in new licenses to handle radiation risks of 3 or lower. The agency lifted the ban two weeks later after modifying its procedures to require either a face-to-face meeting or site visit, McGaffigan said. The NRC already requires site visits before issuing licenses to handle material with risk levels of 1 and 2.

McGaffigan, who is to testify on behalf of the NRC at the hearing, acknowledged that one serious hurdle remains. "We have to fix the problem of people taking our licenses and counterfeiting them," he said.

In a report in 2006 and again this year, the NRC's inspector general criticized NRC officials for failing to detect and understand security flaws in its licensing process.

Coleman and other critics say the NRC essentially has ignored warnings for years and has done too little to remedy problems that would make it easier for someone to make a dirty bomb. Coleman called the NRC's efforts since June 1 "baby steps" that are insufficient and particularly outrageous because the agency has taken so long to act despite having been warned of serious flaws for more than four years.

When GAO investigators briefed Coleman on the results of the most recent operation, they said they focused the sting on West Virginia in part to show how close to the nation's capital a terrorist could build a bomb. Such proximity would reduce the chance of detection during transport to a target, the GAO briefers said, according to Senate staff members who heard the briefing.

In addition, by operating from West Virginia, the GAO undercover investigators were required to deal directly with the NRC. That's because West Virginia is one of more than a dozen states, including Virginia and the District of Columbia, that don't have their own system for issuing licenses for the handling of radioactive material and monitoring those who apply for them.

During the sting operation, an NRC official speaking to one of the phony businessmen on the phone said the agency needed to speak to the man's boss. The GAO agent put him on hold for a minute or two, then picked up the call without disguising his voice but pretending to be his boss, according to people familiar with the GAO investigation. The NRC reviewer accepted the calls at face value.

By contrast, the GAO investigators failed to obtain a license in Maryland, which is one of 34 states that under agreement with the NRC conduct their own licensing. Maryland officials told the disguised GAO employees that state inspectors would have to visit their company and perform other checks, which would take at least seven months. At that point, the phony businessmen withdrew their application, the report says.