This is the accessible text file for GAO report number GAO-14-209 entitled 'Nuclear Nonproliferation: Stronger Planning and Evaluation Needed for Radiological Security Zone Pilot Project' which was released on March 6, 2014. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Report to Congressional Committees: March 2014: Nuclear Nonproliferation: Stronger Planning and Evaluation Needed for Radiological Security Zone Pilot Project: GAO-14-209: GAO Highlights: Highlights of GAO-14-209, a report to congressional committees. Why GAO Did This Study: have raised concerns that certain types of radioactive material could be used to make a terrorist weapon, known as a radiological dispersal device or a “dirty bomb.” Such material, which is typically sealed in a metal capsule known as a sealed radiological source, is commonly used worldwide in medical and industrial settings. To help secure these sources, in 2012, NNSA began an RSZ pilot project in two countries. The National Defense Authorization Act for Fiscal Year 2013 mandated GAO to, among other things, assess efforts to establish RSZs. In this study, GAO (1) examined current federal efforts to secure radiological sources in the United States and in foreign countries and (2) assessed NNSA's efforts to plan for and establish an RSZ pilot project. GAO reviewed relevant regulations and guidance for securing U.S. and international radiological sources, as well as NNSA's RSZ pilot project documents; examined GAO guidance and professional practices for planning and evaluating pilot projects; interviewed officials from NNSA, NRC, State, and the Department of Homeland Security; and obtained written responses to questions from IAEA. What GAO Found: Two U.S. agencies-—the Nuclear Regulatory Commission (NRC) and the National Nuclear Security Administration (NNSA)—-have several ongoing efforts, both in the United States and internationally, to secure radiological sources that could be used to make a terrorist weapon. These efforts include strengthening regulatory requirements, upgrading security, and recovering unwanted or abandoned radiological sources. Domestically, NRC has worked to strengthen regulatory requirements to provide reasonable assurance that U.S. licensees protect high-risk radiological sources. In addition, at the request of licensees, NNSA provides voluntary security upgrades designed to raise security to a level above existing regulatory requirements, consistent with best practices that NNSA has identified. These upgrades include, for example, motion sensors and alarms that are tracked by staff at remote monitoring centers. Internationally, NRC has spent about $12 million since 2002 to help countries establish and strengthen their regulatory frameworks. From fiscal year 2008 through March 2013, NNSA has spent about $304 million to help remove or secure radiological sources in foreign locations. However, NNSA officials said that applying the highest standards and best practices used for domestic security upgrades may not be feasible in some other countries, in part, because some countries do not have the reliable communication systems needed to support the most up-to-date remote monitoring systems. In 2012, NNSA established a radiological security zone (RSZ) pilot project that seeks to establish and sustain the highest standard of physical security measures and best practices at specific sites in Mexico City and Peru, but it did not complete some important planning and evaluation steps. NNSA undertook several planning steps, including identifying the scope of project activities and developing a project schedule to track the progress of project activities, which are expected to cost about $10 million. However, it did not engage some key stakeholders—such as NRC, the Department of State (State) and the International Atomic Energy Agency (IAEA)—early on while planning its pilot project or develop a specific evaluation plan for the project. By not following the professional practice of early engagement of key stakeholders, NNSA may have missed opportunities to obtain and leverage the expertise, perspectives, and resources of these agencies. For example, if IAEA had been involved early in the RSZ pilot project, it could have shared its expertise and perspectives based on its long- standing involvement in regional radiological security collaborations. Regarding the evaluation plan, NNSA officials told GAO that they will evaluate the completed pilot project to determine whether it was sufficiently successful to merit expanding RSZ projects to other countries. However, NNSA has not developed a specific plan to evaluate the pilot project's success that includes several key features of a well-developed evaluation plan. For example, such a plan would include well-defined, clear, and measurable project objectives that would demonstrate the success of the project. Having a specific and well- developed evaluation plan could help NNSA enhance the credibility and effectiveness of future RSZ projects, if NNSA decides to continue beyond its current pilot project. What GAO Recommends: GAO recommends that NNSA, if it proceeds with further work beyond its current RSZ pilot project, (1) obtain stakeholder expertise and perspectives and (2) develop a specific evaluation plan for RSZs. NNSA agreed with these recommendations. View [hyperlink, http://www.gao.gov/products/GAO-14-209]. For more information, contact Steve D. Morris at (202) 512-3841 or morriss@gao.gov. [End of section] Contents: Letter: Background: Federal Agencies Have Several Ongoing Efforts to Secure Radiological Sources in the United States and in Foreign Countries: NNSA Established an RSZ Pilot in Two Countries, but It Did Not Complete Some Important Planning and Evaluation Steps: Conclusions: Recommendations for Executive Action: Agency Comments: Appendix I: Scope and Methodology: Appendix II: Probabilities and Potential Consequences of Terrorist Attacks with Nuclear or Radiological Weapons: Appendix III: Estimates of Buildings outside the United States Housing High-Risk Radiological Sources over 1,000 Curies: Appendix IV: International Coordination by NNSA and NRC to Secure Radiological Material Abroad: Appendix V: Examples of Regional Collaboration to Improve Security of Radiological Sources: Appendix VI: Comments from the National Nuclear Security Administration: Appendix VII: Comments from the Nuclear Regulatory Commission: Appendix VIII: GAO Contact and Staff Acknowledgments: Tables: Table 1: Radionuclides and Associated Thresholds, Measured in Curies, Identified as Warranting Enhanced Security and Protection: Table 2: NNSA's Key Objectives and Examples of Best Practices for Its Domestic Security Upgrades Program: Table 3: Estimates of Buildings outside the United States with High- Risk Radiological Sources in Excess of 1,000 Curies in 93 Other-Than- High-Income Countries, by Region: Table 4: Regional Collaboration Project Summaries and Participating Countries: Figure: Figure 1: Example of a Radiological Source That Contains Americium-241: Abbreviations: AFRA: African Regional Cooperative Agreement for Research, Development, and Training Related to Nuclear Science and Technology: ANSTO: Australian Nuclear Science and Technology Organization: DHS: Department of Homeland Security: DOE: Department of Energy: GTRI: Global Threat Reduction Initiative: IAEA: International Atomic Energy Agency: IND: improvised nuclear device: NNSA: National Nuclear Security Administration: NRC: Nuclear Regulatory Commission: OSRP: Off-site Source Recovery Project: RDD: radiological dispersal device: RED: radiological exposure device: RSZ: radiological security zone: RTG: radioisotope thermoelectric generator: State: Department of State: [End of section] United States Government Accountability Office: GAO: 441 G St. N.W. Washington, DC 20548: March 6, 2014: Congressional Committees: U.S. and international security experts have raised concerns that certain types of commercially available sources of radioactive materials could be combined with an explosive device and used by terrorists to construct a crude but potentially dangerous weapon known as a radiological dispersal device or a "dirty bomb." For commercial uses, radioactive material--such as cesium-137, cobalt-60, and americium-241--is typically sealed in a capsule made of metal--such as stainless steel, titanium, or platinum--to prevent its dispersal; these capsules are often referred to as sealed radiological sources. [Footnote 1] Radiological sources are commonly used throughout the United States and other countries for many beneficial purposes, such as diagnosing and treating cancer, sterilizing blood, preserving food, detecting flaws in pipeline welds, and exploring for oil and gas. Such radiological sources are often located in hospitals and universities, which are typically open environments. The small size and portability of many radiological sources also makes them vulnerable to theft or misuse when they are not adequately secured. An attack with a dirty bomb would not likely cause many deaths; however, it could have significant impacts. For example, in 2002, the Federation of American Scientists concluded that an attack with a dirty bomb composed of an americium source combined with 1 pound of explosives would require that the population of an area 10 times larger than the area hit by the immediate blast receive medical supervision and monitoring. A dirty bomb explosion could also cause significant social and economic impacts from public panic, decontamination costs, and prolonged denial of access to the explosion area while the area is being decontaminated. A 2004 study by the National Defense University noted, for example, that the economic impact on a major populated area from a successful dirty bomb attack is likely to equal, or perhaps exceed, that of the September 11, 2001, terrorist attacks on New York City and the Pentagon. Past accidents involving radiological sources illustrate the types of health and decontamination problems that could occur in the case of a dirty bomb attack. For example, a serious radiological accident occurred in Goiânia, Brazil, in September 1987, which resulted in four deaths and the contamination of 249 people. Moreover, the accident and its aftermath caused about $36 million in damages to the region, and the decontamination process, which required the demolition of homes and other buildings, generated about 3,500 cubic meters of radioactive waste. Concerns about thefts of radiological sources and the possible consequences of a dirty bomb attack persist. For example, their potential vulnerability to theft was highlighted in December 2013 when a truck in Mexico carrying a dangerous cobalt-60 source formerly used in medical treatment was stolen, but it was recovered a few days later. According to officials at the National Nuclear Security Administration (NNSA),[Footnote 2] the incident is still under investigation by Mexican officials, and it is currently uncertain whether the intended target of the theft was the truck or the source. Moreover, according to a nonproliferation expert writing in the Bulletin of the Atomic Scientists, had the pressure cooker explosive devices used in the April 2013 Boston bombing contained radioactive material, every aspect of the emergency and law enforcement response would have been significantly more complicated.[Footnote 3] Among other things, a radioactively contaminated crime scene could have hampered immediate assistance to victims and delayed acquisition of the photos and video that helped identify the bombers. Given the concerns that radiological sources could be used in a dirty bomb, the President of the Partnership for Global Security[Footnote 4] proposed during a congressional hearing in March 2012 that the United States assist in efforts to secure these sources by establishing a U.S.-international initiative to create "radiological security zones" (RSZ) in key regions around the world.[Footnote 5] Under the Partnership for Global Security proposal, NNSA would work with foreign countries to, among other things, review national regulations and discuss security upgrade options. According to the Partnership for Global Security, the establishment of RSZs, if successful, could be a stepping stone to new regional collaborations on nuclear security. In this context, Section 3150 of the National Defense Authorization Act for Fiscal Year 2013 mandated GAO to study U.S. efforts to secure radiological sources, both domestically and abroad, and assess certain aspects of regional radiological security zones.[Footnote 6] Specifically, this report (1) examines current federal efforts to secure radiological sources in the United States and in foreign countries and (2) assesses NNSA's efforts to plan for and establish an RSZ pilot project in foreign countries. To conduct this work, we reviewed relevant literature, regulations, and guidance for overseeing radiological sources, including NNSA's documentation for its RSZ pilot project. We interviewed agency officials at NNSA, the Nuclear Regulatory Commission (NRC), the Department of Homeland Security (DHS), and the Department of State (State). We also interviewed the President of the Partnership for Global Security, who proposed the concept of RSZs, and obtained written responses to questions that we submitted to the International Atomic Energy Agency (IAEA).[Footnote 7] To examine current federal efforts to secure radiological sources in the United States and in foreign countries, we reviewed documents and program guidance and interviewed officials responsible for overseeing or securing radiological sources domestically and in foreign countries at NRC, NNSA, and DHS. We reviewed prior GAO reports on U.S. efforts to secure radiological sources domestically and in foreign countries. We obtained information from IAEA about U.S. efforts to work with IAEA on radiological security programs. To assess NNSA's efforts to plan for and establish an RSZ pilot project in foreign countries, we interviewed officials at NNSA responsible for overseeing and implementing the agency's RSZ pilot project. We reviewed documents and guidance on the RSZ pilot project and analyzed cost data pertaining to both the RSZ pilot project and past efforts to implement radiological security upgrades at the pilot project locations. We assessed the reliability of these data and found the data to be sufficiently reliable for our reporting purposes. We also identified and reviewed prior GAO reports and practices used by professional evaluators for planning and evaluating pilot projects. We interviewed representatives from the Partnership for Global Security and agency officials from NNSA, NRC, DHS, and State to discuss potential challenges to establishing RSZs internationally. Appendix I presents the scope and methodology of our review in more detail. We conducted this performance audit from February 2013 to March 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: The IAEA Code of Conduct on the Safety and Security of Radioactive Sources (Code of Conduct)--which, as of October 2013, had received political commitments for implementation from the United States and 118 other countries--is a well-established international norm for identifying high-risk radiological sources.[Footnote 8] The Code of Conduct lists 16 radionuclides[Footnote 9] that are commonly used in radiological sources, classifying the most dangerous as Category 1 and Category 2.[Footnote 10] The categories are based upon the relative health hazards for each radionuclide at certain threshold levels. If not managed safely or securely, according to the Code of Conduct, Category 1 radiological sources could lead to permanent injury (such as burns requiring surgery) to an individual in contact or in close proximity to the source for more than a few minutes and death to an individual in contact or in close proximity for more than a few minutes to an hour. For a Category 2 radiological source, permanent injury could result to an individual in contact or in close proximity to the source for minutes to hours, and death could result from exposure for a period from hours to days. The United States uses IAEA's Code of Conduct as guidance to define high-risk radiological sources that warrant enhanced security and protection in light of potential terrorist threats, including the use of a radiological dispersal device. Because terrorists could use radioactive material from one or more radiological sources to construct a weapon, the United States also uses the Code of Conduct as guidance to identify high-risk quantities of radioactive material. More specifically, a U.S. interagency task force,[Footnote 11] which was mandated in 2005 to help protect and secure radiological sources, has examined security concerns for Category 1 or Category 2 quantities of radioactive material--namely, radioactive material aggregated in a location that in total meets or exceeds the Category 1 or Category 2 thresholds in the Code of Conduct. In its 2010 report,[Footnote 12] the task force evaluated high-risk radionuclides based on their health hazards--the same basis as in the Code of Conduct--as well as on their potential economic, social, and psychological consequences if used in a radiological dispersal device (e.g., a dirty bomb) or a radiological exposure device.[Footnote 13] (See appendix II for a discussion of the different probabilities and consequence of a terrorist attack using radiological sources versus nuclear material.) The task force concluded that Category 1 and Category 2 quantities of 16 radionuclides listed in the Code of Conduct pose the highest risk and thus warrant enhanced security and protection. (See table 1 for the high-risk radionuclides identified by the task force.) Table 1: Radionuclides and Associated Thresholds, Measured in Curies, Identified as Warranting Enhanced Security and Protection: Radionuclide: Americium (Am)-241; International Atomic Energy Agency (IAEA) Category 2 threshold: 16 curies; IAEA Category 1 threshold : 1,600 curies. Radionuclide: Americium (Am)-241/beryllium; International Atomic Energy Agency (IAEA) Category 2 threshold: 16 curies; IAEA Category 1 threshold: 1,600 curies. Radionuclide: Californium (Cf)-252; International Atomic Energy Agency (IAEA) Category 2 threshold: 5 curies; IAEA Category 1 threshold : 500 curies. Radionuclide: Curium (Cm)-244; International Atomic Energy Agency (IAEA) Category 2 threshold: 14 curies; IAEA Category 1 threshold : 1,400 curies. Radionuclide: Cobalt (Co)-60; International Atomic Energy Agency (IAEA) Category 2 threshold: 8 curies; IAEA Category 1 threshold: 800 curies. Radionuclide: Cesium (Cs)-137; International Atomic Energy Agency (IAEA) Category 2 threshold: 27 curies; IAEA Category 1 threshold: 2,700 curies. Radionuclide: Gadolinium (Gd)-153; International Atomic Energy Agency (IAEA) Category 2 threshold: 270 curies; IAEA Category 1 threshold: 27,000 curies. Radionuclide: Iridium (Ir)-192; International Atomic Energy Agency (IAEA) Category 2 threshold: 22 curies; IAEA Category 1 threshold: 2,200 curies. Radionuclide: Promethium (Pm)-147; International Atomic Energy Agency (IAEA) Category 2 threshold: 11,000 curies; IAEA Category 1 threshold: 1,100,000 curies. Radionuclide: Plutonium (Pu)-238; International Atomic Energy Agency (IAEA) Category 2 threshold: 16 curies; IAEA Category 1 threshold: 1,600 curies. Radionuclide: Plutonium (Pu)-239/beryllium; International Atomic Energy Agency (IAEA) Category 2 threshold: 16 curies; IAEA Category 1 threshold: 1,600 curies. Radionuclide: Radium (Ra)-226; International Atomic Energy Agency (IAEA) Category 2 threshold: 11 curies; IAEA Category 1 threshold: 1,100 curies. Radionuclide: Selenium (Se)-75; International Atomic Energy Agency (IAEA) Category 2 threshold: 54 curies; IAEA Category 1 threshold: 5,400 curies. Radionuclide: Strontium (Sr)-90 (yttrium-90); International Atomic Energy Agency (IAEA) Category 2 threshold: 270 curies; IAEA Category 1 threshold: 27,000 curies. Radionuclide: Thulium (Tm)-170; International Atomic Energy Agency (IAEA) Category 2 threshold: 5,400 curies; IAEA Category 1 threshold: 540,000 curies. Radionuclide: Ytterbium (Yb)-169; International Atomic Energy Agency (IAEA) Category 2 threshold: 81 curies; IAEA Category 1 threshold: 8,100 curies. Source: GAO analysis of The 2010 Radiation Source Protection and Security Task Force Report. Note: The activity threshold for Category 1 sources is 100 times that for Category 2 sources, as defined by the IAEA. [End of table] A 2008 National Research Council report indicates some of these radionuclides raise greater security concerns because of their prevalence in the United States or their physical characteristics.[Footnote 14] According to the report, four of these-- americium-241, cesium-137, cobalt-60, and iridium-192--account for nearly all (over 99 percent) of the radiological sources that pose the highest security risks in the United States. (Fig. 1 illustrates an americium-241 radiological source.) The National Research Council report stated that cesium-137 in the form of cesium chloride raises special security concerns because it is a dispersible powder, soluble in water, and present in large population centers across the country. The U.S. interagency task force periodically reassesses whether factors such as the threat environment have changed and whether the list of radionuclides warranting enhanced security and protection needs to be changed. Figure 1: Example of a Radiological Source That Contains Americium-241: [Refer to PDF for image: photograph] Source: DOE. [End of figure] In the United States, radiological sources for commercial applications are licensed and regulated by NRC or Agreement States, that is, by states that have a signed agreement with NRC authorizing them to regulate certain uses of radioactive materials within their borders. As of July 2013, there were 37 Agreement States. NRC and Agreement States work together to create a U.S. regulatory framework designed to prevent unauthorized use of radioactive material; the framework includes licensing, inspection, and enforcement. NRC and state regulators conduct periodic inspections to ensure that those licensed to possess radiological sources are meeting security requirements. Federal Agencies Have Several Ongoing Efforts to Secure Radiological Sources in the United States and in Foreign Countries: NRC and NNSA--the two federal agencies primarily involved in securing radiological sources in the United States and foreign countries--have several ongoing efforts to do so, including strengthening regulatory requirements, upgrading security, and recovering unwanted or abandoned radiological sources. NNSA is using the lessons learned from its domestic efforts as a model for its current international assistance, but NNSA officials said that applying the highest standards and best practices used for domestic security upgrades may not be feasible in some other countries because of certain constraints. NRC Regulatory Requirements: NRC and regulators in the 37 Agreement States have sought to strengthen regulatory requirements and oversight of licensees, with a focus on the high-risk radioactive material--that is, Category 1 and Category 2 sources and quantities. These changes are intended to provide reasonable assurance of preventing the theft or diversion of high-risk material. The regulatory framework contains requirements governing: (1) access to and use of high-risk radioactive materials; (2) background investigations on individuals who are to be allowed unescorted access to high-risk radioactive materials; (3) the monitoring, detection, assessment of and response to actual or attempted unauthorized access to high-risk radioactive materials; (4) reporting of actual or attempted theft, sabotage or diversion of high- risk radioactive materials; (5) coordination with local law enforcement officials; and (6) protection of high-risk radioactive materials during transport. In addition, to improve regulators' oversight of the possession of the currently more than 75,000 Category 1 and Category 2 radiological sources in the United States, NRC deployed the National Source Tracking System in 2009 to track these sources over their life cycles.[Footnote 15] Licensees are required by regulation to enter information on the manufacture, receipt, transfer, or disposal of these sources into NRC's database. In 2012, we found that NRC had taken a risk-based approach that allowed licensees to develop security programs specifically tailored to their U.S. hospitals and medical facilities.[Footnote 16] However, we found NRC's approach was not based on facility-specific security risks and had resulted in a wide variety of security measures implemented by the medical facilities we visited. Licensees had implemented these broad requirements in various ways, leaving some facilities' radiological sources more vulnerable than others. The risk- based requirements did not consistently ensure the security of high- risk radiological sources as several of the medical facilities we visited did not have adequate security measures in place, which left the sources more at risk for sabotage and theft. One reason we found for the inconsistent security was that NRC security controls did not prescribe the specific measures that licensees should take to secure their sources, such as specific direction on the use of cameras, alarms, and other physical security measures. We recommended that NRC (1) strengthen security requirements by providing hospitals and medical facilities with specific measures they must take to develop and sustain a more effective security program, (2) ensure that federal and state inspectors receive more comprehensive training to improve their security awareness and ability to conduct related security inspections, and (3) supplement existing guidance for facility officials who may be responsible for implementing NRC's security controls. In its response to these recommendations, NRC said that it disagreed that its security requirements needed strengthening through more prescriptive security measures, stating that its performance- based approach provides adequate protection and gives licensees the flexibility to tailor effective security measures across a wide variety of licensed facilities. However, in response to the other two recommendations, NRC stated that inspectors would receive updated training after it reviewed and revised its inspector qualification program and that it plans to develop additional guidance to licensees on how to comply with regulatory requirements. NNSA's Domestic Security Upgrades Program: NNSA conducts a domestic program that provides voluntary security upgrades when requested by licensees that use radiological sources in the United States. These upgrades are designed to raise security at U.S. facilities with high-risk radiological sources to a level above NRC and the Agreement State's regulatory requirements, which are intended to be the minimum requirements that reasonably assure adequate protection. When requested by the licensee, NNSA assesses existing security conditions, recommends security upgrades, funds the procurement and installation of jointly agreed-upon security measures that are consistent with best practices NNSA has identified, and provides a 3-to 5-year warranty period for maintaining the security upgrades. The upgrades are intended to constitute a security system that serves NNSA's key program objectives of detecting, delaying, and responding to thefts of radiological sources. (Table 2 describes key objectives and best practices identified by NNSA.) Table 2: NNSA's Key Objectives and Examples of Best Practices for Its Domestic Security Upgrades Program: Key objectives: Delay access to radiological sources; Examples of best practices: Security upgrades--such as security doors, bulletproof glass, and grating over windows--are designed to increase the time needed by a potential adversary to enter a room or building containing radiological sources. The National Nuclear Security Administration (NNSA) also funds the installation of hardware (known as an in-device delay kit) for certain devices to slow access to the radiological sources within them. Key objectives: Prompt detection and reliable notification of unauthorized access; Examples of best practices: A suite of detection upgrades--such as iris scanners, door alarms, motion sensors, cameras, wireless electronic tamper-indicating seals, and area radiation monitors--are intended to promptly alert an armed-response force to unauthorized access to radiological sources and thereby increase the likelihood of a timely response. A key feature of enhanced notification for response forces is a remote monitoring system that transmits detection alarms and information to on-site and off-site monitoring stations. Remote monitoring systems are intended to address two key security vulnerabilities: (1) reliable transmission of alarms to the responders and (2) the insider threat from site personnel, who may possess knowledge of security procedures and weaknesses. Key objectives: Well-trained and equipped responders; Examples of best practices: A well-trained and well-equipped response force is expected to better interrupt and neutralize a potential adversary. NNSA has developed an alarm response training course run by the Y-12 National Security Complex in Oak Ridge, Tennessee, to help prepare responders to protect themselves and the public when responding to a security incident. Source: GAO analysis of NNSA data. [End of table] NNSA's program has some structural and budgetary limitations. First, as we noted in our 2012 report, the program is voluntary and, therefore, NNSA's upgrades are made only if requested by licensees. [Footnote 17] As of July 2012, 14 hospitals and medical facilities had declined to participate in NNSA's security upgrades program. At that time, these 14 facilities contained over 41,000 curies of high-risk radioactive material, and 4 are located in large urban areas that NNSA officials consider high-risk targets. Second, we reported that there are sustainability concerns. For example, NNSA asks facilities to commit to sustaining upgrades but, according to the agency, it does not have the authority to require that facilities maintain the installed security upgrades beyond the agency's 3-to 5-year warranty period. As we stated in our 2012 report, several hospitals and law enforcement officials told us that not having a requirement to sustain NNSA's upgrades limits the program's impact. Third, NNSA officials told us that, since our 2012 report, NNSA has postponed the estimated completion of its U.S. security upgrades from 2025 until 2044 because NNSA faces significant budget constraints. As a result, some sites with high-risk radiological sources will not receive security upgrades for decades. As of the end of June 2013, NNSA officials reported spending about $140 million to complete security upgrades on 491 of a projected 2,917 buildings with high-risk radiological sources. NNSA estimates the completion of additional security upgrades for all the buildings will cost between $519 million and about $690 million. However, NNSA is still determining whether certain security building upgrades are within its program scope, which creates uncertainty about the program's eventual costs. Specifically, NNSA officials told us that they have not fully assessed storage buildings for mobile devices, such as radiography cameras used in field operations to inspect the integrity of pipeline welds and, therefore, have not decided whether to upgrade security at these buildings. We are currently reviewing federal security efforts for these mobile devices and other industrial radiological sources and plan to report on this issue in 2014. NNSA's domestic security program also supports remote monitoring systems for radiological sources in some existing monitoring centers, which may be established by law enforcement agencies or can be operated by a commercial monitoring company. These centers provide off- site monitoring of alarm and video data from facilities housing radiological sources and allow law enforcement agencies to monitor and respond to security incidents. NNSA has helped support remote monitoring in New York City, Hawaii, and at 10 Department of Agriculture irradiator facilities located in the United States and Central America. According to NNSA, as of March 2013, the agency had spent about $500,000 to provide remote monitoring software development and alarm signal integration, among other things, at these facilities in the United States. Because participation in this program is also voluntary, NNSA officials told us that they have no plan to integrate the existing remote monitoring centers into a comprehensive regional structure within the United States. Domestic Recovery of Unwanted or Abandoned Radiological Sources: NNSA operates the Off-site Source Recovery Project (OSRP) in the United States, which is designed to collect certain disused and unwanted or abandoned ("orphan") radiological sources that pose a potential risk to national security or public health or safety.[Footnote 18] This recovery project includes collecting Category 1 or 2 sources, which are of most concern for national security, but it is not limited to these radiological sources. The interagency task force has raised the concern that licensees are keeping radiological sources in long-term storage because of a lack of a disposal path, particularly as a result of the limitations on disposal at facilities formed through compacts between states, or because of the high costs of disposal.[Footnote 19] For radiological sources that have commercially available disposal pathways, NNSA awards a grant to the Conference of Radiation Control Program Directors,[Footnote 20] which works with state regulators to educate owners of disused sources about disposal options, guide them through the process of commercial source disposal and, in some cases, share costs, as incentives to licensees to give up their disused sources. For certain other disused or abandoned sources that present public health and safety or national security concerns and that do not have a commercial disposal pathway, NNSA prioritizes their recovery according to threat reduction criteria developed in coordination with NRC. According to NNSA officials, sources that have been recovered by NNSA to date have been consolidated and disposed of at DOE facilities. NNSA officials reported that, from 2009 until June 2013, about 2 percent of the almost 14,000 collected radiological sources were Category 1 or 2. These collected Category 1 and 2 sources accounted for around 98 percent of the activity recovered. NNSA officials also reported spending an average of about $15 million annually from 2009 through 2012 on the grants and OSRP collections. According to NNSA officials, OSRP does not have a projected final cost or end date because the total number of disused and unwanted or abandoned radiological sources is not fully known, and it is uncertain when disposal options that would end the need for the project will become available.[Footnote 21] NRC and NNSA Assist Foreign Countries with Strengthening Regulations, Upgrading Security, and Recovering Radiological Sources: NRC has assisted certain countries in the former Soviet Union since the early 2000s and is currently also assisting countries in Latin America, Africa, and the Middle East to establish and strengthen regulatory controls over the safety and security of radiological sources. Specifically, NRC assists these countries' regulatory authorities to adopt and implement key provisions of IAEA's Code of Conduct, such as developing and maintaining a national registry for radiological sources. For instance, in early 2013, NRC provided training on developing a national registry of radiological sources to staff of the Radiation Protection Authority in Zambia and to staff of the nuclear regulatory commission in Jordan. According to NRC officials, since 2002, NRC has spent about $12 million to assist regulators in over 35 countries. NNSA has assisted with securing or removing radiological sources in more than 85 countries since the inception of its international security program in 2002.[Footnote 22] (App. III discusses NNSA's estimate of locations outside the United States housing high-risk radiological sources.) Working in cooperation with foreign counterparts and international agencies, NNSA has conducted site-level security assessments and installed physical security upgrades such as access controls, surveillance cameras, motion sensors and alarms, and hardened windows and doors. NNSA also has provided warranty service, maintenance service, and preventative maintenance activities for an initial period of at least 3 years after installing the security equipment. NNSA also has provided training and workshops for regulatory authorities and response forces on topics such as how to develop regulations to strengthen security of radiological sources, securely manage radiological sources, and respond to alarms. From fiscal year 2008 through March 2013, NNSA reported spending about $220 million on securing radiological sources in foreign countries. In addition, NNSA has supported the removal of disused and unwanted or abandoned sources in foreign countries. This assistance has focused primarily on the removal and disposition of radioisotope thermoelectric generators (RTG) from Russia. RTGs--large devices designed to provide electric power to navigational facilities such as lighthouses and weather stations--present a particularly high security risk because they hold high-activity radiological sources containing from 25,000 to 250,000 curies of strontium-90. During fiscal year 2012, NNSA removed 34 RTGs. In limited cases, NNSA also has repatriated disused sources of U.S. origin, or helped recover disused sources and secure them in centralized storage facilities within the country they were most recently used. From fiscal year 2008 through March 2013, NNSA reported spending about $84 million to help remove or dispose of radiological sources in foreign countries. (See appendix IV for a fuller discussion of NRC's and NNSA's international coordination to help secure radiological sources.) Constraints on NNSA's Efforts to Raise International Radiological Security to a Common Standard: NNSA is using the lessons learned from its domestic radiological source security program as a model for its current international efforts, but it faces constraints in applying this model. In 2010, NNSA revised its security-upgrade guidance to incorporate lessons learned from its domestic program and established a set of what it considers to be best practices for radiological security upgrades at all facilities worldwide. NNSA officials told us that the best practices added to its 2010 guidance primarily include remote monitoring systems, in-device delay kits, and alarm response training. To be consistent with these updated best practices, according to NNSA officials, NNSA is providing additional assistance at overseas sites where security improvements were made prior to the new guidance. NNSA officials told us that the additional security upgrades are intended to raise each country's security to a common standard to the extent possible. However, they said that establishing the highest standards and best practices used for domestic security upgrades may not be feasible when assisting some other countries because of certain constraints. For instance, in-device delay kits are not widely available for many devices internationally because NNSA has mainly developed kits for blood and research irradiators in the United States, which are devices rarely used in other countries where NNSA provides assistance. Further, NNSA officials told us the installation of the most up-to-date remote monitoring systems may not be feasible in countries without reliable communications systems to support the use of the Internet, which is needed to send alarm and video data to monitoring stations. Consequently, they said the security upgrades they provide at some sites may be limited to less advanced technology, which can still provide an adequate level of security but may not be equal to the upgrades that can be used in the United States. NNSA Established an RSZ Pilot in Two Countries, but It Did Not Complete Some Important Planning and Evaluation Steps: In 2012, NNSA established an RSZ pilot project in two Latin American countries, but the agency did not engage some key stakeholders early on while planning its pilot project and has not developed a specific evaluation plan, thereby potentially missing opportunities to obtain and leverage the expertise, perspectives, and resources of those stakeholders and limiting its ability to evaluate the final results of the project. NNSA Is Implementing an RSZ Pilot Project in Mexico and Peru: NNSA took steps to establish an RSZ pilot project at sites in Mexico and Peru in 2012 after the Partnership for Global Security proposed that the United States could showcase an RSZ project as a successful nonproliferation project at the 2014 Nuclear Security Summit.[Footnote 23] The President for the Partnership for Global Security, as well as officials from NRC and State, considered NNSA as the agency most likely to lead the RSZ project because of its long experience with international radiological source security. NNSA defines an RSZ as a geographical area, such as a city, state, country, or region, in which stakeholders are committed to establishing and sustaining the highest standard of physical security measures and best practices. According to NNSA, these best practices should include the following, among others: * a robust and holistic regulatory framework that governs secure radiological source transportation, possession, and disposition; * multiple access controls that use biometric technology, such as iris scanners, to restrict access to radiological sources; * redundant alarms and video feeds from multiple sites that are sent to a centralized monitoring facility; * enhanced delay measures to allow response forces to arrive in time with sufficient strength to contain an adversary; and: * the ability to locate and recover orphan sources. NNSA's definition incorporates the physical security measures and best practices in its 2010 security-upgrade guidance, and assumes that the highest standards possible in the United States--such as a mature regulatory framework, remote monitoring systems, and delay measures such as in-device delay kits--might also be implemented in foreign countries through an RSZ project. As a result, NNSA's current RSZ framework represents an extension of its ongoing international radiological security assistance, with more emphasis on helping to bring countries' physical security measures and best practices to the highest standards possible. NNSA officials said that they selected Mexico and Peru among a pool of possible locations because the officials believed NNSA could complete the pilot project in these locations before the 2014 Nuclear Security Summit, for several reasons. First, NNSA officials said Mexico and Peru did not have potential access issues presented by some higher- priority countries that were considered less politically stable. [Footnote 24] For example, NNSA officials told us the political instability in North Africa and the Middle East following the events of the Arab Spring hindered NNSA from gaining access to countries in those regions.[Footnote 25] Second, NNSA officials said that proximity to the United States, as well as travel costs, became an important factor in selecting Mexico and Peru because of agency budget constraints. Third, according to NNSA officials, both countries already had relatively mature regulatory frameworks in place, and NNSA had established good working relations with the governments of Mexico and Peru based on past radiological security projects. For instance, Mexico and Peru had already received about $11.4 million of radiological security assistance from NNSA from fiscal year 2008 through fiscal year 2012.[Footnote 26] Following the selection of Mexico and Peru, NNSA officials worked with government officials in both countries to identify specific sites within each country to include in the pilot project. According to NNSA officials, they limited project sites to those housing at least 1,000 curies of radioactive material because of budget constraints that restricted the number of sites that could be upgraded. Moreover, NNSA officials told us that, in Mexico, budget constraints also led them to limit their project to sites in Mexico City because it would be too expensive to include all sites throughout the country that meet the threshold of 1,000 curies. NNSA ultimately selected nine sites in Mexico City and nine sites in Peru for inclusion in the pilot project. Of the nine sites in Peru, seven are located in and around Lima, and two are located in other cities. The sites in Mexico City and Peru include medical, agricultural, and research facilities. Based on site assessments completed in Mexico City in September 2012 and in Peru in November 2012, NNSA determined the upgrades needed to bring each site's security up to the highest standards possible. The types of upgrades, which vary by site, included advanced access- control systems using biometric technology such as iris scanners; enhanced delay measures such as in-device delay kits; and tamper- detection devices. NNSA officials said that these types of upgrades could strengthen sites' abilities to delay and detect malevolent activities, such as theft or sabotage. In addition, NNSA officials said they have completed the initial installations of remote monitoring systems at all sites in the pilot project and identified the locations where off-site monitoring will be performed. According to NNSA officials, the remote monitoring systems, which will improve the sites' capability to respond to security incidents in a timely manner, are expected to be completed in early 2014. NNSA has also assisted regulators in each country with the drafting of national security regulations. According to NNSA officials, Peru's national security regulation has been enacted, and collaboration continues with Mexico on finalizing the current draft regulations. In addition, NNSA has been working with each country's regulators to conduct response force and transportation security training and develop a national response plan. NNSA has also conducted the first of two training courses focused on searching for and securing orphan sources in Mexico and Peru. NNSA plans to complete this training and national-level assistance in 2014. NNSA expects to spend approximately $10 million during fiscal years 2013 and 2014 to implement the RSZ pilot project, about half of which are surplus funds from NNSA work on other nonproliferation projects that was either delayed or canceled for political or technical reasons. Of the estimated $10 million, about $4.5 million is allocated to the Mexico City projects and about $5.5 million to Peru. However, NNSA officials told us that the final costs will not be known until the pilot project is completed in 2014. NNSA officials acknowledged that the RSZ pilot is not regional in the sense proposed by the Partnership for Global Security, which called for engaging two or more countries in regional collaboration. Specifically, the pilot independently assists Mexico and Peru and does not involve any regional collaboration between the two countries. However, NNSA officials said that regional collaboration might take place after the pilot is completed. For example, NNSA officials said that a meeting or workshop may be convened so that representatives from the United States, Mexico, and Peru can discuss any successes and lessons learned from the RSZ pilot project. NNSA officials also said that Mexico and Peru could serve as role models for other countries in Latin America and the Caribbean by sharing lessons learned and best practices during regional workshops that Mexico and Peru could potentially host or attend. In addition, the RSZ pilot project does not address the merit or potential value of creating cross-country regional remote monitoring of radiological sources, as envisioned in the Partnership for Global Security's original RSZ concept, in part because such monitoring may not be feasible. Specifically, officials from both NNSA and NRC said that countries would generally be unwilling to share specific information about their radiological sources because this information is often viewed as sensitive or classified. Outside this current pilot project, there have been other past instances of regional radiological security collaboration. During the course of our review, we identified at least seven other regional collaborations to improve the security of radiological sources, with some dating back to the early 1990s. For example, in 2012, IAEA established an interregional project, partly funded by NNSA, to assist participating countries in the Mediterranean region to strengthen their national management and regulatory infrastructure on the control of radiological sources. (For additional information on these other regional collaborations on radiological security, see appendix V.) NNSA Did Not Engage with Some Key Stakeholders When Planning Its RSZ Pilot Project or Develop a Specific Evaluation Plan: NNSA used its existing project planning process for implementing the RSZ pilot project, according to NNSA officials, but it did not engage with some key stakeholders during this planning or develop a specific evaluation plan for the project. In planning the RSZ pilot, NNSA undertook several steps, including identifying the scope of project activities to be conducted in both Mexico and Peru, developing a project schedule to track the progress of project activities, and setting milestones for completion. NNSA officials said that the project activities and milestones are similar to those for its ongoing domestic and international radiological security upgrade projects. As with the RSZ pilot project, these project activities and milestones are guided by NNSA's 2010 guidance for radiological security improvements. Therefore, the planning done by NNSA for the RSZ pilot largely mirrored its previous planning for its domestic and international radiological security efforts and relied upon the experience gained from those prior planning efforts. However, the agency did not engage some key stakeholders--including some other agencies that are actively involved in international radiological security efforts--early on when defining an RSZ and planning its pilot project. As we have previously reported and according to professional practices, stakeholders should be engaged early in the process of planning and developing a pilot project. [Footnote 27] Early stakeholder engagement in pilot projects can ensure that multiple perspectives are considered; build ownership; and help generate political commitment, including support for any potential expansion of project activities. Activities to engage stakeholders early include, for example, seeking stakeholder input on the design of the project and obtaining stakeholder feedback on the implementation process. When planning the RSZ pilot project in late 2012, NNSA officials said they engaged with stakeholders in Mexico and Peru at the national level--including the countries' national regulators and federal police--and with staff at the sites participating in the pilot project. However, the officials acknowledged that they did not have early discussions or agreements with other key stakeholders, such as NRC and State, on the RSZ definition, an essential element of the project's design; the pilot project plan; implementation of the pilot; potential challenges; and potential opportunities for resource sharing related to the RSZ pilot project. IAEA officials also confirmed to us that NNSA had exchanged little information with them on the RSZ pilot project. According to NNSA officials, because the RSZ pilot project fell within the scope of their existing security assistance mission, they did not need to seek other agencies' perspectives, consensus, or permission early on to proceed with the pilot. In addition, NNSA officials stated that because the pilot project needed to be implemented under a condensed schedule in order to be completed before the 2014 Nuclear Security Summit, there was limited opportunity to engage stakeholders early in the planning process. NNSA officials said that when they did discuss the RSZ pilot project with other agencies, such as NRC and State, it was after they had planned and started the project. Nonetheless, by not engaging early with key stakeholders such as NRC, State,[Footnote 28] and IAEA, NNSA may have missed opportunities to obtain and leverage the expertise, perspectives, and resources of these agencies. For example, NRC, which helps foreign countries to strengthen their regulatory framework, could have shared lessons learned from its interactions with other countries' regulatory authorities. Moreover, IAEA could have shared expertise based on its long-standing involvement in regional collaborations regarding radiological security. In addition, engaging key stakeholders could have allowed NNSA to obtain different perspectives and ideas on how to address some of the potential challenges to establishing RSZs that officials from U.S. agencies and IAEA identified during our review or to identify potential opportunities for resource sharing. For instance, officials from both NNSA and NRC said that some countries may face challenges sustaining the physical security and technological upgrades provided under an RSZ project. In particular, countries that are economically challenged may be unable to sustain the costs of operating and maintaining high-technology security upgrades over the long-term. However, by not engaging NRC on this issue, NNSA did not obtain NRC officials' ideas on how to address the potential sustainability challenges. For example, NRC officials told us that they believed that NNSA's reliance upon an approach requiring high- technology security upgrades, such as biometric access controls and advanced remote monitoring systems, may create unsustainable costs and that a less high-technology approach is more appropriate and sustainable for less prosperous countries. Moreover, NNSA officials acknowledged that gaining access to some of the high-priority countries or regions of the world could be challenging. In particular, they said that it may not be feasible for the United States to gain access to every high-priority country because some of these countries are unwilling to partner with the United States. In such cases, IAEA, which provides security assistance to more than 100 member states, might be in a position to partner with NNSA to implement an RSZ project in a country or region where NNSA does not have access. NNSA officials told us that they will evaluate the pilot project when completed in 2014 to determine whether the project was sufficiently successful to merit expanding RSZ projects to other countries. However, NNSA did not develop a specific plan to evaluate the pilot project's success. As we have previously reported, for pilot projects, a well-developed evaluation plan can help ensure that agencies obtain the information necessary to make effective program and policy decisions.[Footnote 29] A well-developed evaluation plan should include, at a minimum, several key features, including the following: * well-defined, clear, and measurable objectives for the pilot project; * criteria or standards for determining pilot project performance; * a clearly articulated evaluation methodology and strategy for comparing the pilot project results with those of other efforts; * a clear plan that details the type and source of data necessary to evaluate the pilot project, methods for data collection, and the timing and frequency of data collection; and: * a detailed data-analysis plan to track the program's performance and evaluate the final results of the pilot project. NNSA officials said they did not develop a specific evaluation plan for the RSZ pilot project because they intend to evaluate the pilot project's results using a standard evaluation tool that NNSA applies to all of its international security upgrades projects. However, the features of NNSA's evaluation tool do not fully constitute a well- developed evaluation plan. As discussed below, NNSA's intended evaluation of its RSZ pilot has some key features of a well-developed evaluation plan, but other key features are only partially developed or not developed. * Project objectives--partially developed. NNSA's pilot project activities to implement its best practices, such as completing the installation of remote monitoring systems or assisting with regulations, serve as a list of measurable project objectives. However, NNSA has not defined or clarified the extent to which these project objectives conform to the corresponding objectives in its definition of RSZs. For example, it is not clear whether completing the regulatory assistance in Mexico meets the objective of a "robust and holistic regulatory framework" in NNSA's RSZ definition, or whether Mexico would need additional regulatory changes to meet that objective. Moreover, clear and measurable objectives help ensure that the appropriate evaluation data are collected and that performance can be measured against the objectives. * Performance standards--not developed. NNSA did not develop and document criteria or standards for determining pilot project performance, which are necessary for determining the extent to which the pilot project is effective. Specifically, NNSA officials were unable to state what results--e.g., what threshold of security improvements --would demonstrate a successful RSZ pilot. NNSA officials subsequently told us they believe that the uniform and complete implementation of all the best practices articulated in the agency's RSZ definition at the participating RSZ sites would demonstrate a successful pilot. However, to have a clear performance standard, NNSA would have to clarify how each of the planned project objectives would be assessed as successfully achieved and how they would cumulatively constitute the uniform and complete implementation of all the best practices of its RSZ definition. * Evaluation methodology--developed. NNSA has developed an evaluation strategy for comparing the pilot project results with other efforts. NNSA officials told us that they intend to compare (1) measurement of security levels before and after the pilot for the 18 participating RSZ sites and (2) the pilot countries' results (such as developing national regulations) to the results of other countries receiving radiological security upgrades from NNSA outside of the RSZ project. * Data collection plan--developed. NNSA has a plan to collect data for the pilot project. According to NNSA officials, they are applying an evaluation tool, composed of 75 questions, which NNSA routinely applies when assisting with radiological security internationally. Responses to the questions are used to measure, among other things, the effectiveness of NNSA-provided security upgrades and training and whether a country's regulatory authority is effective at adopting regulations for the security of radiological sources. However, NNSA officials told us it is not easy to quantify the strength and completeness of language in regulations, which is more adequately measured by observing future enforcement successes and by using formal reports or anecdotal comments from the country's regulators. NNSA may not, however, have timely data for reasonably assessing its regulatory assistance at the completion of the RSZ pilot project. * Data analysis plan--not developed. NNSA has not developed a data analysis plan detailing how project performance will be tracked and criteria for how the final results of the project will be evaluated, and the standard evaluation tool that NNSA applies to all of its international security upgrades does not include such criteria. It is not clear, therefore, what NNSA can conclude, for instance, from measured changes in security levels before and after the RSZ pilot project without having criteria to determine successful performance. It is also unclear what it can conclude about the likely results of additional RSZ projects in other countries that may not have the positive characteristics of Mexico and Peru, which partially determined their selection for the pilot project. Not having all the key features of a well-developed evaluation plan specific to the RSZ pilot project limits NNSA's ability to evaluate the final results of the project and use those results to enhance the credibility and effectiveness of future RSZ projects, if any. Conclusions: NNSA has worked to rapidly complete an RSZ pilot project in advance of the 2014 Nuclear Security Summit and to determine whether the highest standards of security for radiological sources can be implemented in foreign countries. While working to meet a condensed schedule for pilot project completion, however, NNSA did not engage some key stakeholders when planning the project or develop a specific evaluation plan for its project. In particular, NNSA did not engage with some key stakeholders, such as NRC, State, and IAEA, early in the process in order to seek their perspectives on defining RSZs and planning the pilot project before its implementation. By not engaging early with such key stakeholders, NNSA may have missed opportunities to obtain and leverage the expertise, perspectives, and resources of these agencies. For example, if IAEA had been involved early in the RSZ pilot project, it could have shared its expertise and perspectives, as well as ideas on how to address some of the potential challenges to establishing RSZs, based on its long-standing involvement in regional radiological security collaborations. Moreover, engaged stakeholders are more likely to support any potential expansion of RSZ projects than those who had little input. Implementing and evaluating a pilot project can be challenging, especially given the individual characteristics of the sites and countries involved in NNSA's international security efforts. Using a well-developed and documented evaluation plan that includes key features can help ensure that a pilot project is implemented and evaluated in ways that generate reliable information to inform future program development decisions. NNSA plans to evaluate the pilot project after it is completed in 2014 and then to decide whether it was sufficiently successful to warrant expanding RSZ projects to other countries, but the agency has not developed a specific plan with well- defined, clear, and measurable project objectives, among other things, to evaluate the pilot project's success. A specific evaluation plan for the pilot project that includes all the key features of a well- developed plan can help ensure that agencies obtain the information necessary to make effective program and policy decisions. Having such a plan could also help NNSA enhance the credibility and effectiveness of future RSZ projects, if NNSA decides to continue beyond its current pilot project. Recommendations for Executive Action: If NNSA proceeds with further work on RSZs beyond its current pilot project, we recommend that the Administrator of NNSA take the following two actions: * Ensure that the perspectives of key stakeholders, such as NRC, State, and IAEA, are fully considered when planning and implementing any future RSZ projects. Specifically, obtain and incorporate stakeholder expertise and perspectives on the definition of RSZs, planning of future RSZ projects, potential challenges, and opportunities for resource sharing. * Develop a specific evaluation plan for RSZs that includes the key features of a well-developed plan, such as: - well-defined, clear, and measurable objectives for the pilot project; - criteria or standards for determining pilot project performance; and: - a detailed data-analysis plan to track the program's performance and evaluate the final results of the pilot project. Agency Comments: We provided a draft of this report to the Administrator of NNSA, the Chairman of NRC, the Secretary of Homeland Security, and the Secretary of State. NNSA and NRC provided written comments, which are presented in appendixes VI and VII. NRC also provided technical comments, which we incorporated as appropriate. DHS and State did not provide comments. In its written comments, NNSA stated that initial RSZ activities were part of a limited pilot project. As a result, not all of the broader planning principles typically implemented for long-term projects were applied. However, if NNSA decides to consider implementing the RSZ concept on a larger scale, NNSA agreed to implement our recommendations. NRC generally agreed with the report. We are sending copies of this report to appropriate congressional committees; the Administrator of the National Nuclear Security Administration; the Secretaries of the Departments of Energy, Homeland Security, and State; the Chairman of the Nuclear Regulatory Commission; and other interested parties. In addition, the report is available at no charge on the GAO website at [hyperlink, http://www.gao.gov]. If you or your staff members have any questions about this report, please contact me at (202) 512-3841 or morriss@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VIII. Signed by: Steve D. Morris Acting Director, Natural Resources and Environment: List of Committees: The Honorable Carl Levin: Chairman: The Honorable James M. Inhofe: Ranking Member: Committee on Armed Services: United States Senate: The Honorable Thomas R. Carper: Chairman: The Honorable Tom Coburn: Ranking Member: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Robert Menendez: Chairman: The Honorable Bob Corker: Ranking Member: Committee on Foreign Relations: United States Senate: The Honorable Howard P. "Buck" McKeon: Chairman: The Honorable Adam Smith: Ranking Member: Committee on Armed Services: House of Representatives: The Honorable Edward R. Royce: Chairman: The Honorable Eliot L. Engel: Ranking Member: Committee on Foreign Affairs: House of Representatives: The Honorable Michael T. McCaul: Chairman: The Honorable Bennie G. Thompson: Ranking Member: Committee on Homeland Security: House of Representatives: [End of section] Appendix I: Scope and Methodology: We focused our review primarily on the Department of Energy's National Nuclear Security Administration (NNSA) and the Nuclear Regulatory Commission (NRC) because they are the principal federal agencies with responsibility for securing radiological sources in the United States and both provide assistance to foreign countries to help secure their radiological sources. We also performed work at the Department of Homeland Security (DHS) and the Department of State because they, too, are involved in securing radiological sources. In addition, we obtained written responses to questions we submitted to the International Atomic Energy Agency (IAEA) regarding their experience in securing radiological sources in foreign countries and to obtain their views on how radiological sources could be secured under the concept of radiological security zones (RSZ). We also interviewed representatives from the Partnership for Global Security about the RSZ concept. We limited the scope of our work to radioactive materials used in radiological sources in commercial applications, as these sources are the main focus of federal efforts. In particular, we focused our review on 16 radionuclides that are commonly used in radiological sources and that may pose a significant risk to individuals, society, and the environment according to IAEA's Code of Conduct on the Safety and Security of Radioactive Sources.[Footnote 30] A U.S. interagency task force established under the Energy Policy Act of 2005 confirmed in a 2010 report that these 16 radionuclides warrant enhanced security and protection.[Footnote 31] Our review does not examine 7 additional radionuclides that the task force found could be of concern in limited situations when the radionuclides are aggregated because they are infrequently shipped or possessed in quantities likely to cause a significant impact if used in a radiological dispersal device. [Footnote 32] We also did not examine other radioactive material, such as spent nuclear fuel or high-level radioactive waste, because these sources present different security concerns from radiological sources. Further, we did not include nuclear materials, such as highly enriched uranium or plutonium, in the scope of our review as these materials also raise different security concerns because of their potential use in an improvised nuclear device. In addition, we did not assess the feasibility, desirability, and cost of (1) establishing RSZs in high-priority areas worldwide; (2) establishing remote regional monitoring centers staffed by personnel from countries participating in an RSZ; or (3) using regional monitoring centers in the United States to secure radiological sources. We agree with NNSA officials that it is premature to assess the feasibility, desirability, and costs of these scenarios for several reasons. First, NNSA's RSZ pilot project is ongoing and has not yet been evaluated to determine whether it was successful or cost- effective. Second, NNSA is not establishing remote regional monitoring centers that would be staffed by personnel from two or more countries participating in an RSZ. Third, NNSA indicated that remote monitoring centers are being used in some capacity to assist with securing radiological sources in the United States, but there is no plan to use remote monitoring centers more widely in domestic efforts to secure radiological sources. Moreover, we did not develop an estimate of the costs associated with NNSA's implementation of an RSZ program because it is premature to do so; NNSA has neither completed its RSZ pilot project nor evaluated the results, so it is not yet clear whether NNSA will pursue implementing an RSZ program. To examine current federal efforts to secure radiological sources in the United States, and in foreign countries, we reviewed documents and guidance and interviewed NRC and NNSA officials responsible for overseeing these efforts. Concerning efforts in the United States, we reviewed NRC regulations, security orders, and guidance for the security of domestic radiological sources and information on NRC's National Source Tracking System. In addition, we reviewed information about NNSA's Domestic Material Protection program, which provides voluntary security upgrades to facilities with high-risk radiological sources. We gathered cost data from NNSA to determine both the amount of money spent by the agency on the voluntary security upgrades and the projected costs to complete its upgrades at all participating facilities. We discussed the reliability of these data with NNSA officials and a GAO methodologist and determined that they were sufficiently reliable to summarize both the program's costs to date and its projected total costs at completion. Additionally, we reviewed how NNSA assists existing remote monitoring centers in the United States that conduct off-site alarm and video data monitoring of facilities using or housing radiological sources. We also interviewed DHS officials to learn how the department collaborates with NNSA to support these centers. We also examined program information and cost data for NNSA's Off-site Source Recovery Project, which is designed to remove certain disused and unwanted or abandoned ("orphan") radiological sources that pose a potential risk to national security or public health or safety. To further inform our work, we reviewed prior GAO reports on efforts to secure radiological sources domestically, including our September 2012 report on federal efforts to secure radiological sources at U.S. medical facilities.[Footnote 33] Concerning efforts in foreign countries, we reviewed information about NRC's assistance to other countries, which primarily focuses on helping those countries with establishing and strengthening their regulatory controls for radiological sources. We obtained estimated cost data illustrating how much money NRC has spent providing radiological source security assistance to other countries since 2002. We also reviewed information, including prior GAO reports, about NNSA's efforts to secure or remove radiological sources in other countries. We gathered and analyzed cost data to determine how much NNSA spent on its efforts to secure or remove radiological sources in foreign countries from fiscal year 2008 through March 2013. We discussed the reliability of these data with NNSA officials and determined that they were sufficiently reliable for the purposes of our review. We also examined information and interviewed NRC and NNSA officials regarding U.S. efforts to coordinate with international partners on radiological security efforts. Additionally, we obtained written responses to questions we submitted to IAEA to learn more about U.S. efforts to work with IAEA on radiological security programs. Further, we reviewed NNSA's revisions to its radiological security-upgrades guidance, which documents what the agency considers to be its best practices for radiological source security, to determine how NNSA applies these practices to its international efforts. We also interviewed NNSA officials to determine how, if at all, NNSA applies these updated best practices to its international radiological security efforts. To assess NNSA's efforts to plan for and establish RSZs in foreign countries, we collected and analyzed documents and guidance on the RSZ pilot project and interviewed officials at NNSA responsible for overseeing and implementing the project. We obtained and analyzed budget data, including estimated costs for the pilot project, as of September 2013, and the estimated total costs of prior radiological security upgrades implemented at those sites in Mexico City and Peru participating in the pilot project from fiscal year 2008 to fiscal year 2012. To assess the reliability of these data, we discussed their reliability with knowledgeable NNSA officials and questioned them about the system's internal controls to verify the accuracy and completeness of the data. We found the data to be sufficiently reliable for our reporting purposes. In addition, we identified and reviewed past GAO reports and practices used by professional evaluators for planning and implementing pilot projects, including communicating with relevant stakeholders. In addition, we identified key features of a well-developed evaluation plan for pilot projects identified by previous GAO reports and practices used by professional evaluators for planning and evaluating pilot projects. We found these key features to be relevant to NNSA's RSZ pilot project and analyzed NNSA's evaluation plan to determine the extent to which it had these key features. To obtain agency views about establishing RSZs in foreign countries, we interviewed agency officials at NNSA, NRC, DHS, and State and obtained written responses to questions we submitted to IAEA. We also spoke with representatives from the Partnership for Global Security, including its president, who had proposed the concept of RSZs at a congressional hearing in March 2012. We conducted this performance audit from February 2013 to March 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of section] Appendix II: Probabilities and Potential Consequences of Terrorist Attacks with Nuclear or Radiological Weapons: The terrorist attacks against the United States on September 11, 2001, heightened concerns within the United States and international community about the risk of terrorists pursuing potentially more dangerous avenues of attack, such as the use of nuclear or radiological weapons.[Footnote 34] The probabilities and potential consequences of an attack by terrorists using a nuclear or radiological weapon vary; however, if either type of attack were carried out successfully, it could cause not only loss of life but also enormous psychological and economic damage. Terrorists could seek to carry out a nuclear or radiological attack using the following means: * Improvised nuclear device (IND): An IND is a crude nuclear bomb made with fissile materials, such as highly enriched uranium or plutonium, acquired by purchase, diversion, or force.[Footnote 35] * Radiological dispersal device (RDD): An RDD is designed to radioactively contaminate people or deny the use of any area by spreading radioactive materials into the environment, such as through a dirty bomb explosion or other means. * Radiological exposure device (RED): An RED is designed to expose people to harmful doses of ionizing radiation as they pass by a partially or fully unshielded radiological source that might be concealed in a populated location such as under a subway seat, in a food court, or in a sports arena.[Footnote 36] In light of these threats, the 2011 U.S. National Strategy for Counterterrorism cited the danger of nuclear terrorism as the greatest threat to global security.[Footnote 37] Moreover, a senior official in the Department of Energy's (DOE) National Nuclear Security Administration (NNSA) said that, historically, nuclear security has been given priority over radiological security, which has a much smaller budget within NNSA.[Footnote 38] However, according to a 2011 Congressional Research Service report, it is difficult to know what priority should be given to countering nuclear terrorism using fissile material, as opposed to radiological terrorism, because nuclear and radiological incidents will likely have differing probabilities and consequences.[Footnote 39] For example, one of the challenges faced by terrorists is obtaining the amount of fissile material necessary for constructing an IND.[Footnote 40] In addition, it may be difficult for terrorists to obtain the financial and technical assets needed to build, transport, and carry out a successful IND attack. According to nuclear security experts, the probability of terrorist use of an IND is low, but the consequences of a successful IND attack would be devastating.[Footnote 41] A successful IND attack could produce the same force as the bomb that destroyed Nagasaki, Japan, in 1945. Specifically, the explosion would produce extreme heat, powerful shock waves, and intense radiation that would be immediately lethal to individuals within miles of the explosion; it could also spread radioactive fallout over thousands of square miles. As a result, the explosion could cause hundreds of thousands of deaths and injuries and pose long-term cancer risks to those exposed to the radioactive fallout. A successful IND attack would also cause severe economic impacts--such as those resulting from deaths; illnesses; loss of jobs; and destruction of workplaces, homes, and other infrastructure--that could total hundreds of billions of dollars and take years for recovery.[Footnote 42] In contrast, terrorist use of a radiological weapon, such as an RDD or RED, is thought to be more probable but could have less severe consequences than use of an IND. More specifically, according to security experts, the likelihood of terrorist use of a radiological weapon is considered greater given the prevalent commercial use of radiological sources containing radioactive material and because certain types of radioactive material, such as cesium-137 found in the form of cesium chloride, could be dispersed in a relatively easy way. [Footnote 43] However, compared with a nuclear weapon, a radiological weapon would arguably kill many fewer people and spread radioactive contamination over a much more limited area. For example, depending on the type of RDD, the area contaminated could range from part of a building or city block to several square miles. In the case of a dirty bomb attack, hundreds of individuals might be killed or injured from the explosion or face the risk of later developing cancer induced by exposure to radiation and radioactive contamination. In addition, according to nuclear security experts, the successful use of an RDD, particularly a dirty bomb, could potentially result in billions of dollars of damage. For instance, the local economy of the area attacked by an RDD will be severely affected due to the disruption of commercial activities and the extremely expensive decontamination measures needed for both buildings and land. An attack using an RED could lead to debilitating injuries or fatalities, but the severity of the attack will depend on, among other things, the source used, the proximity of each person to the source, and the duration of exposure. REDs are generally thought of as less of a concern than RDDs because they would likely harm only the people who remained near them for a length of time and would contaminate little to no area.[Footnote 44] Nevertheless, radiation is an especially powerful terrorism weapon because it instills considerable fear. As a result, the mental health consequences of a terrorist attack using a radiological weapon would include effects on those victims directly impacted by the event, as well as the fear, terror, and demoralization transmitted to those not directly affected by the event. [End of section] Appendix III: Estimates of Buildings outside the United States Housing High-Risk Radiological Sources over 1,000 Curies: As we have previously reported, the total number of radiological sources in use worldwide is unknown because many countries do not systematically account for them.[Footnote 45] According to an NNSA estimate, which is summarized in table 3 below, there are about 920 buildings in 93 countries housing high-risk radiological sources in excess of 1,000 curies, but this estimate is limited to locations within other-than-high-income countries as defined by the World Bank. [Footnote 46] Table 3: Estimates of Buildings outside the United States with High- Risk Radiological Sources in Excess of 1,000 Curies in 93 Other-Than- High-Income Countries, by Region: Region[A]: Europe and Central Asia; Number of countries: 24; Estimated number of buildings[B]: 330. Region[A]: Latin America and the Caribbean; Number of countries: 24; Estimated number of buildings[B]: 250. Region[A]: East Asia and the Pacific; Number of countries: 10; Estimated number of buildings[B]: 140. Region[A]: Middle East and North Africa; Number of countries: 9; Estimated number of buildings[B]: 90. Region[A]: Sub-Saharan Africa; Number of countries: 20; Estimated number of buildings[B]: 60. Region[A]: South Asia; Number of countries: 6; Estimated number of buildings[B]: 50. Region[A]: Total; Number of countries: 93; Estimated number of buildings[B]: 920. Source: GAO analysis of NNSA data. [A] Regional categories are based on the World Bank's regional country classification. [B] We have rounded the estimated number of buildings to avoid a false sense of precision because the number of buildings is not precisely known. According to National Nuclear Security Administration (NNSA) officials, their estimated number of buildings is based on NNSA staff visits to sites, information provided to NNSA by national regulators of the host-countries, and approximations of the number of buildings in other countries based on observable population trends, among other things. [End of table] [End of section] Appendix IV: International Coordination by NNSA and NRC to Secure Radiological Material Abroad: The National Nuclear Security Administration (NNSA) and the Nuclear Regulatory Commission (NRC) coordinate with other international partners on radiological security efforts as part of their international work. Coordination includes working bilaterally with host countries on improving their security, sometimes with financial assistance from donor countries; regionally with several countries; or in partnership with the International Atomic Energy Agency (IAEA), Europol,[Footnote 47] and other organizations. Several countries have contributed funds to NNSA's nonproliferation programs, including its efforts to secure radiological sources, as well as nuclear material. Since 2007, for example, NNSA has received funding from Canada, the Czech Republic, the Netherlands, New Zealand, South Korea, and the United Kingdom to use for, among other things, securing or removing of radiological sources in other countries. For instance, in 2013, the Netherlands agreed to contribute $650,000 to support NNSA's projects related to searching for and removing or protecting radiological sources in Kazakhstan. In addition, NNSA has been working regionally with the Australian Nuclear Science and Technology Organisation [Footnote 48] since 2004 to ensure countries in Southeast Asia have the tools to develop and implement secure management, use, and storage of radiological sources. NNSA also provides funding and technical experts to support IAEA's development of guidance and technical documents, IAEA-led training in countries, and IAEA's effort to assist countries with securing sites with radiological sources. NNSA also provides funding to the World Institute for Nuclear Security, a nongovernmental organization, to develop best practices and host workshops with international partners on nuclear and radiological source security. With regard to NRC, it cooperates with IAEA on developing nuclear safeguards, nonproliferation, and international regulatory standards for radioactive material, as well as providing bilateral safety and safeguards advice, training, and other assistance to countries that seek U.S. help to improve their regulatory programs. [End of section] Appendix V: Examples of Regional Collaboration to Improve Security of Radiological Sources: The idea of using regional collaboration to improve the security of radiological sources, which is one of the main tenants of the radiological security zone concept as originally envisioned, has been previously applied. During the course of our review, we identified several additional examples of regional collaboration projects to improve participating countries' security of radiological sources, as summarized in table 4 below. Table 4: Regional Collaboration Project Summaries and Participating Countries: Project: Strengthening Cradle-to-Grave Control of Radiological Sources in the Mediterranean Region; Summary: In 2012, the International Atomic Energy Agency (IAEA) established an interregional project, partly funded by the National Nuclear Security Administration (NNSA) and the European Union, to assist participating countries in the Mediterranean region to strengthen their national management and regulatory infrastructure for the control of radiological sources. The project also seeks to foster international cooperation between the participating countries and to encourage development of a harmonized regional "cradle-to-grave" approach to managing radiological sources; Participating countries[A]: Albania, Bosnia and Herzegovina, Croatia, Cyprus, Egypt, Ghana, Greece, Jordan, Lebanon, Macedonia, Malta, Montenegro, Morocco, Nigeria, Slovenia, Tunisia, Turkey, United Republic of Tanzania, and the United States. Project: NNSA's Global Threat Reduction Initiative (GTRI) Search and Secure Training; Summary: In January 2009, GTRI conducted training in Tunisia on how to search for and secure orphan radiological sources. Afterward, GTRI provided the Arabic and French versions of the training material to Tunisian authorities, allowing them to host training on this material for countries in North Africa and the Middle East. The training hosted by Tunisia was funded by the Arabic Atomic Energy Commission; Participating countries[A]: Countries participating in the training hosted by Tunisia included eight countries from North Africa and the Middle East. Project: Latin American Regional Partnership with IAEA; Summary: In 2007, GTRI joined with IAEA and the U.S. Department of State in a Latin American Regional Partnership to, among other things, identify and dispose of disused and unwanted radiological sources that could be used by terrorists for malicious purposes. Moreover, the effort sought to initiate cooperative efforts within the region to return unwanted, vulnerable radiological sources to their country of origin or to the United States for secure storage and disposition. The partnership, which included five Latin American countries, has since ended; Participating countries[A]: Argentina, Brazil, Colombia, United States, Uruguay, and Venezuela. Project: Southeast Asia Regional Radiological Security Partnership; Summary: In 2004, the Australian Nuclear Science and Technology Organization (ANSTO), NNSA, and IAEA formed the Southeast Asia Regional Radiological Security Partnership. The effort aims to take a regional approach to improving the security of high-risk radiological sources in participating countries by better protecting and controlling such sources, among other things; Participating countries[A]: Australia, Bangladesh, Brunei, Canada, Cambodia, Indonesia, Laos, Malaysia, Myanmar, Nepal, New Zealand, Philippines, Singapore, Sri Lanka, Thailand, United Kingdom, United States, and Vietnam. Project: Ibero-American Forum of Radiological and Nuclear Regulatory Agencies; Summary: The Ibero-American Forum, established in 1997, provides a mechanism for the nuclear regulatory bodies of participating countries to share their experiences and knowledge in order to improve nuclear and radiological security in their respective countries. The forum has held plenary sessions, and it works to share knowledge and initiate activities focused on the safety and security of nuclear and radioactive material. For example, one activity focuses on the safe management of radiological sources. The objective of this activity is to ensure the practical implementation of control procedures for the import and export of radiological sources in Ibero-American countries by following the guidelines of IAEA's Code of Conduct on the Safety and Security of Radioactive Sources and Guidance on the Import and Export of Radioactive Sources; Participating countries[A]: Argentina, Brazil, Chile, Cuba, Mexico, Peru, Spain, and Uruguay. Project: IAEA Model Project on Upgrading Radiation Protection Infrastructure; Summary: The Model Project, initiated in 1994, focused on establishing and/or upgrading national radiation safety infrastructure in various IAEA member states. The project focused on five project milestones that comprised the establishment of (1) a regulatory framework; (2) occupational exposure control; (3) medical exposure control; (4) public exposure control; and (5) emergency preparedness and response. By the end of 2004, IAEA chose to pursue the project through five thematic safety areas, which reflected the five original milestones, and emphasized a more regional approach. This new approach was based on growing recognition that each region--Africa, Asia and the Pacific, Europe, and Latin America--faced unique challenges and that it was imperative to find ways to increase sharing of knowledge and experience at the regional level to keep pace with technological evolution and standards development; Participating countries[A]: The Model Project was originally envisioned as an interregional project with five participating countries, but by 2004, the project finished with 91 participating countries in Africa, Asia and the Pacific, Europe, and Latin America. Project: African Regional Cooperative Agreement for Research, Development, and Training Related to Nuclear Science and Technology (AFRA); Summary: AFRA is an intergovernmental agreement established in 1990 by IAEA and IAEA member states in Africa to further strengthen and enlarge the contribution of nuclear science and technology to socioeconomic development on the African continent. NNSA has also provided funding to IAEA and technical expertise to support AFRA activities. One activity focuses on radiation and waste safety and nuclear security. Under this activity, AFRA promotes member states' self-assessment of their regulatory infrastructure and radiation protection services, among other things. AFRA also provides training through regional workshops focusing, for example, on using IAEA methodology to develop a national strategy in radiation safety and on the protection of radiological sources; Participating countries[A]: Algeria, Angola, Benin, Botswana, Burkina Faso, Burundi, Cameroon, Central African Republic, Chad, Côte d'Ivoire, Democratic Republic of the Congo, Egypt, Ethiopia, Gabon, Ghana, Kenya, Lesotho, Libya, Madagascar, Malawi, Mali, Mauritania, Mauritius, Morocco, Mozambique, Namibia, Nigeria, Seychelles, Sierra Leone, South Africa, Sudan, Tunisia, Uganda, United Republic of Tanzania, and Zimbabwe. Sources: GAO analysis of AFRA, ANSTO, IAEA, Ibero-American Forum, and NNSA documents. [A] In some cases, countries that played a role in providing funding, training, and/or technical expertise are considered participating countries. [End of table] [End of section] Appendix VI: Comments from the National Nuclear Security Administration: Department of Energy: National Nuclear Security Administration: Office of The Administrator: Washington DC 20585: February 14, 2014: Mr. Steve D. Morris: Acting Director: Natural Resources and Environment: Government Accountability Office: Washington, DC 20458: Dear Mr. Morris: Thank you for the opportunity to review the Government Accountability Office's (GAO) draft report titled "Nuclear Nonproliferation: Stronger Planning and Evaluation Needed for Radiological Security Zone Pilot Project, GA0-14-209." I understand the GAO conducted this work in response to a congressional mandate to: 1) examine current federal efforts to secure radiological sources in the United States and in foreign countries; and 2) assess the National Nuclear Security Administration's (NNSA) efforts to plan for and establish a Radiological Security Zone (RSZ) Pilot Project. Based on its findings, the GAO provided two recommendations for executive action should NNSA proceed with further RSZ work beyond its current pilot project. GAO's recommendations propose the application of best practices and standard planning principles for project development and execution going forward. As the initial RSZ activities were part of a limited pilot project, not all of the broader reaching planning principles typically implemented for a long-term project were applied at that time. However, as with all of its ongoing projects, if NNSA chooses to consider implementing the RSZ concept on a larger scale, we will implement the GAO's recommendations including: 1) consulting with the Chairman of the Nuclear Regulatory Commission, the Department of State, the International Atomic Energy Agency, and other key stakeholders to ensure all perspectives are considered; and 2) work to better define project objectives and create specific milestones to determine project performance. NNSA firmly believes in the principles of strong project management and will continue to monitor its projects with its award winning "G2" project management information system. If you have any questions regarding this response, please contact Dean Childs, Director, Office of Audit Coordination and Internal Affairs, at (301) 903-1341. Sincerely, Signed by: Edward Bruce Held: Acting Administrator: [End of section] Appendix VII: Comments from the Nuclear Regulatory Commission: United States Nuclear Regulatory Commission: Washington, D.C. 20555-0001: February 19, 2014: Mr. Glen Levis: Assistant Director, Natural Resources and the Environment: U.S. Government Accountability Office: Washington, DC 20546: Dear Mr. Levis: On behalf of the U.S. Nuclear Regulatory Commission (NRC), I am responding to Mr. Steve D. Morris's letter dated January 14, 2014, requesting NRC's comments on the U.S. Government Accountability Office (GAO) proposed report GAO-14-209, "Nuclear Nonproliferation: Stronger Planning and Evaluation Needed for Radiological Security Zone Pilot Project." We appreciate the opportunity to provide our comments for your consideration. As requested, the NRC has reviewed the draft report and is in general agreement with the draft report. The NRC has certain technical comments. These comments are detailed in the enclosure. Sincerely, Signed by: Mark A. Satorius: Executive Director for Operations: Enclosure: NRC's Technical Comments on Draft GAO Report GAO-14-209. [End of section] Appendix VIII: GAO Contact and Staff Acknowledgments: GAO Contact: Steve D. Morris, (202) 512-3841 or morriss@gao.gov: Staff Acknowledgments: In addition to the individual named above, Glen Levis (Assistant Director), Terry Hanford, and Kevin Remondini made key contributions to this report. Other assistance was provided by Jeffrey Barron, Alisa Beyninson, Kevin Bray, Pamela Davidson, and Cynthia Norris. [End of section] Footnotes: [1] This report focuses on radioactive material used for commercial applications, which is typically found in sealed radiological sources, hereafter referred to as radiological sources. For the purposes of this report, the term "radioactive material" excludes nuclear material (i.e., highly enriched uranium and plutonium), which could be used for a nuclear weapon. [2] NNSA was created by title XXXII the National Defense Authorization Act for Fiscal Year 2000, Pub. L. No. 106-65 (1999). It is a separate semiautonomous agency within the Department of Energy (DOE), with responsibility for the nation's nuclear weapons, nonproliferation, and naval reactors programs. [3] George M. Moore, "If the Boston Marathon Attack Had Involved Dirty Bombs," Bulletin of the Atomic Scientists, Web edition, May 1, 2013, accessed June 13, 2013. [hyperlink, http://www.thebulletin.org/web- edition/features/if-the-boston-marathon-attack-had-involved-dirty- bombs]. [4] The Partnership for Global Security is a nonprofit research organization that conducts a global, cooperative effort to keep nuclear and radioactive materials safe and secure. The organization works closely with many governments and international experts to develop new security initiatives and to ensure the timely and effective implementation of existing nonproliferation programs. [5] The Nuclear Security Summit and Global Nuclear Security Governance for the 21st Century: Hearing Before the S. Comm. on Homeland Security and Governmental Affairs, Subcomm. on Oversight of Government Management, the Federal Workforce, and the District of Columbia, 112th Cong., (2012) (statement of Kenneth N. Luongo, President, Partnership for Global Security). [6] Pub. L. No. 112-239, § 3150, 126 Stat. 1632, 2201 (2013). [7] Based in Vienna, Austria, IAEA is an independent international organization that is affiliated with the United Nations. It has the dual mission of promoting the peaceful uses of nuclear energy and verifying that nuclear materials intended for peaceful purposes are not diverted to military purposes. IAEA also assists other countries with the safety and security of their radiological sources. [8] IAEA, Code of Conduct on the Safety and Security of Radioactive Sources (Vienna, Austria: 2004). [9] Radionuclides are unstable isotopes of an element that decay or disintegrate spontaneously, thereby emitting radiation. [10] In IAEA's Categorization of Radioactive Sources (Vienna, Austria: 2005), it describes five categories of radiological sources in terms of their hazards, ranging from the most dangerous, Category 1, to least dangerous, Category 5, which is defined as the most unlikely to be dangerous if close to a person. IAEA's categorization concentrates on dangers that immediately threaten lives or cause permanent injuries, and it does not consider possible delayed health effects such as radiation-induced cancer that exposed persons might later develop. [11] Under the Energy Policy Act of 2005, a U.S. interagency task force is required--not less than once every 4 years--to evaluate and provide recommendations to the President and Congress related to securing U.S. radiological sources from terrorist threats. The Task Force is composed of representatives from the NRC (Chair), DHS, Department of Defense, DOE and NNSA, Department of Transportation, Department of Justice, State, Office of the Director of National Intelligence, Central Intelligence Agency, Federal Emergency Management Agency, Federal Bureau of Investigation, Environmental Protection Agency, Office of Science and Technology Policy, and Department of Health and Human Services. The task force includes a nonvoting member representing two professional organizations that work on radiation protection and with NRC on regulatory issues. [12] Radiation Source Protection and Security Task Force, The 2010 Radiation Source Protection and Security Task Force Report (Washington, D.C.: 2010). [13] A radiological dispersal device is designed to radioactively contaminate people and an area by spreading radioactive materials, such as through a dirty bomb explosion or other means. In contrast, a radiological exposure device is designed to expose people to harmful doses of ionizing radiation as they pass by a partially or fully unshielded radiological source that might be concealed in a populated location. [14] National Research Council, Radiation Source Use and Replacement: Abbreviated Version. (Washington, DC: The National Academies Press, 2008). The National Research Council is the operating arm of the National Academy of Sciences and National Academy of Engineering. Through its independent, expert reports; workshops; and other scientific activities, its mission is to improve government decision making and public policy, increase public understanding, and promote the acquisition and dissemination of knowledge in matters involving science, engineering, technology, and health. [15] In addition, NRC expanded the list of nationally tracked radiological sources by adding four radionuclides (i.e., actinium-227, polonium-210, thorium-228, and thorium-229) not included in IAEA's list of Category 1 and 2 radionuclides. [16] GAO, Nuclear Nonproliferation: Additional Actions Needed to Improve Security of Radiological Sources at U.S. Medical Facilities, [hyperlink, http://www.gao.gov/products/GAO-12-925] (Washington, D.C.: Sept. 10, 2012). [17] [hyperlink, http://www.gao.gov/products/GAO-12-925]. [18] A radiological source that is no longer being used for its authorized purpose is called disused. It is generally considered an orphan if it is no longer under regulatory control, such as when the responsible licensee cannot be identified or its possessor is not licensed. [19] Radiation Source Protection and Security Task Force, 2010 Task Force Report. [20] The Conference of Radiation Control Program Directors is a nonprofit organization dedicated to radiation protection. Its members are primarily radiation professionals in state and local government that regulate the use of radiological sources. [21] For additional information on the OSRP, see GAO, Nuclear Security: DOE Needs Better Information to Guide Its Expanded Recovery of Sealed Radiological Sources, [hyperlink, http://www.gao.gov/products/GAO-05-967] (Washington, D.C.: Sept. 22, 2005) and GAO, Nuclear Nonproliferation: DOE Action Needed to Ensure Continued Recovery of Unwanted Sealed Radioactive Sources, [hyperlink, http://www.gao.gov/products/GAO-03-483] (Washington, D.C.: Apr. 15, 2003). [22] In 2007, GAO reported on NNSA's international efforts to secure radiological sources in foreign countries. See GAO, Nuclear Nonproliferation: DOE's International Radiological Threat Reduction Program Needs to Focus Future Efforts on Securing the Highest Priority Radiological Sources, [hyperlink, http://www.gao.gov/products/GAO-07-282] (Washington, D.C.: Jan. 31, 2007). [23] As part of the U.S. President's 2009 pledge to launch a new international effort to secure all vulnerable nuclear material around the world, the President hosted world leaders in Washington, D.C., at the first Nuclear Security Summit, in 2010. At the 2012 Nuclear Security Summit in Seoul, South Korea, world leaders urged countries to secure radioactive materials as well as nuclear materials. [24] Aside from Mexico and Peru, the initial list of 12 candidate countries included 4 countries in North Africa and the Middle East, 3 in the former Soviet Union, and 3 in Southeast Asia. NNSA prioritized the candidate countries, in part, by considering the factors specified in its 2010 security-upgrade guidance. The factors include the type of the radioactive material being stored at sites within the country, the existing security conditions of those sites, and whether the sites are in close proximity to potential high-value targets and U.S. strategic interests. NNSA also takes into consideration the prevalence of terrorist-related activities in the country or surrounding region, among other things. [25] The Arab Spring began in December 2010 in Tunisia. The social unrest in Tunisia soon spread across other North African and Middle East countries, including Bahrain, Egypt, Jordan, Morocco, Syria, and Yemen. By January 2012, the social unrest had led to the ousting of government leaders in Tunisia, Egypt, and Yemen. [26] NNSA officials said that, from fiscal year 2008 to fiscal year 2012, NNSA spent approximately $9.1 million in Mexico, of which about $3.4 million was for Mexico City, and $2.3 million in Peru on radiological source security upgrades. NNSA captures its international radiological source protection cumulative costs at the country level. As a result, NNSA officials estimated the costs for Mexico City based on several assumptions, including attributing 40 percent of the security upgrades completed in Mexico to Mexico City. The total costs for work completed in Mexico City, therefore, could be higher or lower than the estimate provided by NNSA. [27] GAO, Federal Employees: Opportunities Exist to Strengthen Performance Management Pilot, [hyperlink, http://www.gao.gov/products/GAO-13-755] (Washington, D.C.: Sept. 12, 2013); GAO, Program Evaluation: Strategies to Facilitate Agencies' Use of Evaluation in Program Management and Policy Making, [hyperlink, http://www.gao.gov/products/GAO-13-570] (Washington, D.C.: June 26, 2013); World Health Organization, Beginning with the End in Mind: Planning Pilot Projects and Other Programmatic Research for Successful Scaling Up (Geneva, Switzerland: 2011); Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK ® Guide), 5th Edition, (Newtown Square, Penn.: 2013); and FHI 360, Eight Strategies for Research to Practice (Durham, NC: September 2012). [28] State has nonproliferation programs to reduce radiological, nuclear, and other threats, conducts bilateral and multilateral diplomacy to address proliferation threats around the world and provides support to NNSA and other U.S. agency nonproliferation programs working overseas. [29] GAO, Aviation Security: A National Strategy and Other Actions Would Strengthen TSA's Efforts to Secure Commercial Airport Perimeters and Access Controls, [hyperlink, http://www.gao.gov/products/GAO-09-399] (Washington, D.C.: Sept.30, 2009) and GAO, Tax Administration: IRS Needs to Strengthen Its Approach for Evaluating the SRFMI Data-Sharing Pilot Program, [hyperlink, http://www.gao.gov/products/GAO-09-45] (Washington, D.C.: Nov. 7, 2008). See also P.H. Rossi, M.W. Lipsey, and H.E. Freeman, Evaluation: A Systematic Approach (Thousand Oaks, Calif.: 2004). [30] IAEA, Code of Conduct on the Safety and Security of Radioactive Sources (Vienna, Austria: 2004). The Code of Conduct serves as a guide in developing policies, laws, and regulations on maintaining the safety and security of radiological sources. It is not, however, legally binding. The code, which was revised during 2003, includes, among other things, enhanced guidelines for the security of sources. Further, in September 2004, IAEA's Board of Governors approved new guidance on the import and export of sources, which is designed to help countries ensure that high-risk sources are supplied only to authorized end-users. [31] Radiation Source Protection and Security Task Force, The 2010 Radiation Source Protection and Security Task Force Report (Washington, D.C.: 2010). [32] These seven additional radionuclides are iron (Fe)-55; polonium (Po)-210; carbon (C)-14; strontium (Sr)-82; iodine (I)-125 and I-131; and tungsten (W)-188. The task force proposed no recommendation about these radionuclides and enhanced security and protection. [33] [hyperlink, http://www.gao.gov/products/GAO-12-925]. [34] One resulting concern was how major U.S. cities, which are assumed to be the preferred targets of such terrorist attacks, might respond to them. See GAO, Nuclear Terrorism Response Plans: Major Cities Could Benefit from Federal Guidance on Responding to Nuclear and Radiological Attacks, [hyperlink, http://www.gao.gov/products/GAO-13-736] (Washington, D.C.: Sept. 30, 2013). [35] Fissile material is also referred to as weapon-usable nuclear material or strategic special nuclear material. Nuclear material can include highly enriched uranium and plutonium. For the purposes of this appendix, we use both fissile material and nuclear material. [36] Ionizing radiation is any radiation capable of displacing electrons from atoms, thereby producing ions, which are atoms that have fewer or more electrons than protons, which causes them to have an electrical charge and, therefore, be chemically reactive. High doses of ionizing radiation may produce severe skin or tissue damage. Gamma-emitting sources, such as cobalt-60 and cesium-137, pose a threat mainly because even a fraction of a gram emits a huge number of high-energy gamma rays, which are harmful whether outside or inside the body. [37] The White House, National Strategy for Counterterrorism (Washington, D.C.: June 28, 2011). [38] As we similarly reported in 2007, DOE officials told us that securing radiological sources in other countries is a lower priority than securing more dangerous nuclear materials, such as highly enriched uranium and plutonium. As a result, DOE reduced funding for radiological security activities. See [hyperlink, http://www.gao.gov/products/GAO-07-282]. [39] Congressional Research Service, "Dirty Bombs": Technical Background, Attack Prevention and Response, Issues for Congress (Washington D.C.: June 24, 2011). [40] According to IAEA, 25 kilograms of highly enriched uranium or 8 kilograms of plutonium would be needed to manufacture a weapon. [41] For example, see M. Bunn, A. Wier, and J. P. Holdren, Controlling Nuclear Warheads and Materials: A Report Card and Action Plan (Washington, D.C.: Nuclear Threat Initiative and the Project on Managing the Atom, Harvard University, March 2003) and C. Wirz and E. Egger, "Use of Nuclear and Radiological Weapons by Terrorists?," International Review of the Red Cross 87, no. 859 (2005). [42] The National Academies and the U.S. Department of Homeland Security, Nuclear Attack: A Fact Sheet (Washington, D.C.: National Academies of Sciences, 2005) and Homeland Security Council, National Planning Scenarios, Final Version 21.3 (Washington, D.C.: Mar. 1, 2006). [43] Radiological sources are used in medical, industrial, agricultural, and research applications and can be found in a variety of locations, such as hospitals, medical and industrial irradiation facilities, and universities. Cesium-137 is commonly found in the form of cesium chloride, a crystalline salt that is soluble in water and can be readily dispersed if intentionally or accidentally removed from its container. [44] Congressional Research Service, "Dirty Bombs." [45] [hyperlink, http://www.gao.gov/products/GAO-07-282]. [46] The World Bank classifies countries according to per capita Gross National Income into four groups: low income, lower-middle-income, upper-middle-income, and high-income. [47] Europol is the European Union's law enforcement agency that tracks terrorist networks in Europe. [48] The responsibilities of the Australian Nuclear Science and Technology Organisation, an Australian government agency, include advising the Australian government on global nuclear issues and providing expertise for international discussions on nuclear nonproliferation and safety. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO's actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO's website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Katherine Siggerud, Managing Director, siggerudk@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, DC 20548. [End of document]