Nuclear Nonproliferation: Further Actions Needed by U.S. Agencies to Secure Vulnerable Nuclear and Radiological Materials

Published by the Government Accountability Office on 2012-03-14.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                            United States Government Accountability Office

GAO                         Testimony
                            Before the Subcommittee on Oversight of
                            Government Management, the Federal Workforce,
                            and the District of Columbia, Committee on
                            Homeland Security and Governmental Affairs,
                            U.S. Senate

For Release on Delivery
Expected at 2:30 p.m. EDT
Wednesday, March 14, 2012

                            Further Actions Needed by
                            U.S. Agencies to Secure
                            Vulnerable Nuclear and
                            Radiological Materials
                            Statement of Gene Aloise, Director
                            Natural Resources and Environment

                                               March 14, 2012

                                               NUCLEAR NONPROLIFERATION
                                               Further Actions Needed by U.S. Agencies to Secure
                                               Vulnerable Nuclear and Radiological Materials
Highlights of GAO-12-512T, a testimony
before the Subcommittee on Oversight of
Government Management, the Federal
Workforce, and the District of Columbia,
Committee on Homeland Security and
Governmental Affairs, U.S. Senate

Why GAO Did This Study                         What GAO Found
In 2009, President Obama announced             The President’s 4-year initiative is a worthwhile effort designed to accelerate U.S.
an international initiative to secure all      and international efforts to secure nuclear material worldwide. However, as GAO
vulnerable nuclear material worldwide          reported in December 2010, the governmentwide strategy approved by the
within 4 years. Leaders of 47 nations          National Security Council (NSC) for the initiative lacked specific details regarding
endorsed this effort at the 2010               how the initiative will be implemented. As a result, key details associated with the
Nuclear Security Summit and will meet          initiative are unclear, including its overall estimated cost, time frame for
again in March 2012 to evaluate their          completion of work, and scope of planned work. In its 2010 report, GAO
work and set new goals for nuclear             recommended, among other things, that NSC lead the interagency development
security. The United States has been
                                               of a more detailed implementation plan for the President’s 4-year initiative. NSC
a leader in promoting nuclear
                                               did not comment on GAO’s recommendations.
nonproliferation efforts worldwide.
GAO has issued numerous reports on             The United States also faces challenges accounting for and evaluating the
U.S. nonproliferation programs                 security of U.S. nuclear material overseas. As GAO reported in September
administered by several agencies,              2011, federal agencies are not able to fully account for U.S. nuclear material
including the departments of Energy            overseas that is subject to nuclear cooperation agreements. GAO also found that
(DOE), State, and Defense (DOD); and           the agreements do not contain specific access rights that enable agencies to
the Nuclear Regulatory Commission              monitor and evaluate the physical security of U.S. nuclear material overseas.
(NRC). This testimony, which is based          GAO found that the agencies responsible for reviewing foreign partners’ security
primarily on previously issued reports,
                                               are not doing so systematically. GAO suggested that Congress consider
discusses (1) the U.S. strategy to
                                               directing DOE and NRC to fully account for U.S. weapon-usable nuclear
secure all vulnerable nuclear material
within 4 years, (2) U.S. agencies’             materials overseas and consider amending the Atomic Energy Act to require
ability to track and evaluate the              access rights allowing the United States to verify adequate protection of U.S.
security of U.S. nuclear materials             nuclear materials if future agreements cannot be negotiated to include such
transferred to foreign countries,              rights.
(3) challenges coordinating federal            GAO also reported in December 2011 on the challenges in coordinating U.S.
nuclear nonproliferation efforts, and          governmentwide nonproliferation efforts. Specifically, GAO identified potential
(4) preliminary observations regarding
                                               fragmentation and overlap among some U.S. programs that played a role in
GAO’s ongoing work on federal efforts
                                               preventing and detecting the smuggling of nuclear materials overseas. GAO also
to secure radiological sources in U.S.
hospitals and medical facilities. To
                                               found that no single federal agency had the lead responsibility to direct these
conduct its ongoing work, GAO visited          efforts. GAO recommended, among other things, that NSC review U.S.
25 hospitals and medical facilities in 7       programs working to prevent nuclear smuggling overseas to reduce
states and the District of Columbia.           fragmentation and potential overlap. NSC declined to comment on the
GAO is making no new
recommendations, but continues to              In addition to nuclear materials, the Summit plans to address the security of
believe that implementation of the             radiological sources—material that could be used to make a dirty bomb. Based
recommendations made in its recent             on preliminary results from ongoing work on federal efforts to secure radiological
reports complements and supports the           sources in U.S. hospitals and medical facilities, GAO found that NRC’s security
administration’s goal of securing              controls for hospitals and medical facilities do not prescribe the specific steps
vulnerable nuclear material in a timely        that must be taken to protect their radiological sources. GAO also found that
fashion.                                       medical facilities have implemented the controls in various ways. This has
                                               created a mix of security measures at the locations GAO visited that could leave
                                               some facilities more vulnerable than others. DOE’s National Nuclear Security
                                               Administration (NNSA) has established a voluntary program to upgrade the
                                               security of domestic facilities that have radiological sources. NNSA has made
View GAO-12-512T or key components.            progress in securing domestic radiological sources, but some facilities have
For more information, contact Gene Aloise at   declined NNSA’s assistance, including hospitals located in high-risk urban areas.
(202) 512-3841or aloisee@gao.gov.

                                                                                        United States Government Accountability Office
Chairman Akaka, Ranking Member Johnson, and Members of the

I am pleased to participate in this hearing in advance of the Nuclear
Security Summit in South Korea. As you know, in 2009, President Obama
announced an international initiative to secure all vulnerable nuclear
materials around the world within 4 years, and leaders of 47 nations
endorsed this initiative at the 2010 Nuclear Security Summit here in
Washington. The leaders pledged to work together toward this end and
also reaffirmed the fundamental responsibility of nations to maintain
effective security of the nuclear materials and facilities under their control.
At the conclusion of the summit, the leaders agreed to meet again in
South Korea in March 2012 to evaluate their work and set new goals for
nuclear security, including the security of radiological material. We
recognize the importance of the Summit as a way to galvanize
international support for reducing the risks posed by the proliferation of
these dangerous materials and are pleased to see that radiological
material security will be given greater attention. This could provide a more
comprehensive and balanced approach to risk reduction efforts by the
international community.

One of the most serious threats facing the United States and other
countries is the possibility that other nations or terrorist organizations
could steal a nuclear warhead or nuclear weapon-usable materials from
poorly secured stockpiles around the world, 1 or that nations could divert
nuclear material intended for peaceful purposes to the development of
nuclear weapons. Terrorists or countries seeking nuclear weapons could
use as little as 25 kilograms (Kg) of weapon-grade highly enriched
uranium (HEU) or 8 Kg of plutonium to construct a nuclear weapon. Of
great concern is that terrorists could fashion a crude nuclear bomb made
from either HEU or plutonium into an improvised nuclear device (IND). An
IND would create an explosion producing extreme heat, powerful
shockwaves and intense radiation that would be immediately lethal to
individuals within miles of the explosion, as well as radioactive fallout over
thousands of square miles. Nonproliferation experts estimate that a
successful IND could produce the same force as the equivalent yield of
the bomb that destroyed Nagasaki, Japan, in 1945; it could devastate the

 Weapon-usable nuclear materials are highly enriched uranium, uranium-233, and any
plutonium containing less than 80 percent of the isotope plutonium-238. Such materials
are also often referred to as fissile materials or strategic special nuclear materials.

Page 1                                                                       GAO-12-512T
heart of a medium-sized U.S. city. The explosion could cause hundreds of
thousands of deaths and injuries, as well as pose long-term cancer risks
to those exposed to the radioactive fallout.

Radiological material also poses a significant security threat to the United
States and the international community. Radiological material, such as
cobalt-60, cesium-137, and strontium-90, is encapsulated or sealed in
metal—such as stainless steel, titanium, or platinum—to prevent its
dispersal and is commonly called a sealed radiological source. Sealed
radiological sources are used worldwide for many legitimate purposes,
such as medical, industrial, and agricultural applications. The total
number of these sources in use worldwide is unknown because many
countries do not systematically account for them. If certain types of these
sources were obtained by terrorists, they could be used to produce a
simple and crude but potentially dangerous weapon—known as a
radiological dispersion device, or dirty bomb. Although experts believe
that a dirty bomb could result in a limited number of deaths, it could have
severe economic consequences. Depending on the type, amount, and
form, the dispersed radiological material could cause radiation sickness
for people nearby and produce serious economic, psychological and
social disruption associated with the evacuation and subsequent cleanup
of the contaminated area. The economic consequences resulting from the
improper use of radiological materials is not theoretical. Some actual
incidents involving sources can provide a measure of understanding of
what could happen in the case of a dirty bomb attack. For example, in
1987, an accident involving a medical device containing about 1,400
curies of cesium-137, 2 killed four people in Brazil’s Goiania region and
injured many more. The accident and its aftermath caused about $36
million in damages to the region. The decontamination process required
the demolition of homes and other buildings and generated 3,500 cubic
meters of radioactive waste.

To address these threats, respond to the President’s goal of securing
vulnerable nuclear material worldwide within 4 years, and meet the
objectives of the Nuclear Security Summit, U.S. agencies have
undertaken a number of nuclear nonproliferation efforts. Specifically, the

 A curie is a unit of measurement of radioactivity. In modern nuclear physics, it is defined
as the amount of substance in which 37 billion atoms per second undergo radiological
disintegration. In the international system of units, the becquerel is the preferred unit of
radioactivity. One curie equals 3.7 x 1010 becquerels.

Page 2                                                                          GAO-12-512T
National Nuclear Security Administration (NNSA), a separately organized
agency within the Department of Energy (DOE) has more than 20
programs that are intended to, among other things, secure nuclear
warheads; reduce the risk of nuclear smuggling; and protect, consolidate,
and dispose of weapon-usable nuclear material and radiological sources.
The two other U.S. agencies that conduct major nuclear nonproliferation
programs and activities overseas are the departments of Defense (DOD)
and State. DOD administers the Cooperative Threat Reduction program,
which has facilitated the removal of nuclear weapons from Ukraine,
Belarus, and Kazakhstan and has helped Russia and Ukraine meet their
arms control commitments by assisting in the elimination of strategic
delivery systems. State manages its own nonproliferation programs, such
as the Export Control and Related Border Security program, 3 provides
support to NNSA and other U.S. agencies’ nuclear nonproliferation
programs working overseas, and conducts bilateral and multilateral
diplomacy to address proliferation threats around the world under its
Bureau of International Security and Nonproliferation. The Department of
Homeland Security is responsible for, among other things, developing
and deploying technologies to detect, prevent and interdict nuclear
materials smuggled into the United States. National Security Council
(NSC) staff have the principal role in coordinating the implementation of
NNSA, DOD, State, and other agencies’ nonproliferation programs. NSC
oversees development of general policy and establishes guidelines for
U.S. nonproliferation programs, but it does not implement programs or
control their budgets. In addition, the Nuclear Regulatory Commission
(NRC) and NNSA are involved in regulating and/or securing radiological
sources within the United States and in foreign countries.

My statement today is based primarily on reports we issued from
September 2010 to December 2011 that assess various U.S. nuclear
nonproliferation programs and activities that support both the President’s
4-year initiative and, more broadly, the goals of the Summit. Specifically,
I will focus my testimony on (1) the U.S. governmentwide strategy for
supporting the President’s goal of securing all vulnerable nuclear
materials worldwide within 4 years, (2) U.S. agencies’ ability to track and

 The Export Control and Related Border Security program seeks to prevent the
proliferation of weapons of mass destruction and advanced conventional weapons by
helping to build effective national export control systems in countries that possess,
produce, or supply strategic items as well as in countries through which such items are
most likely to transit.

Page 3                                                                        GAO-12-512T
             evaluate the security of U.S. nuclear materials transferred to foreign
             countries, (3) challenges in coordinating federal nuclear nonproliferation
             efforts, and (4) ongoing work on federal efforts to secure radiological
             sources in U.S. hospitals and medical facilities. Detailed information on
             our scope and methodology for our prior work can be found in these
             reports. To develop our preliminary observations on efforts to secure
             radiological sources in U.S. medical facilities, we visited 25 hospitals and
             medical facilities in seven states and the District of Columbia, interviewed
             regulatory officials from 20 states, and interviewed agency officials at
             DOD, DOE, NRC, and the Department of Veterans Affairs (VA). 4 We also
             reviewed relevant laws, regulations, and guidance for overseeing
             commercial radiological sources. We are conducting our ongoing work in
             accordance with generally accepted government auditing standards.
             Those standards require that we plan and perform the audit to obtain
             sufficient, appropriate evidence to provide a reasonable basis for our
             findings and conclusions based on our audit objectives. We believe that
             the evidence obtained provides a reasonable basis for our findings and
             conclusions based on our audit objectives.

             We obtained the views of DOE, DOD, VA and NRC for new information in
             our statement concerning radiological source security at U.S. hospitals
             and medical facilities. We incorporated the agencies’ technical comments
             where appropriate.

             The 2010 Nuclear Security Summit highlighted the global threat posed by
Background   nuclear terrorism and the need for countries to work in a comprehensive
             and concerted fashion to ensure that nuclear materials are not stolen or
             diverted for weapons use. The Summit produced a communiqué, a high-
             level political statement by the leaders of the 47 participating countries.
             The communiqué identified several measures that countries planned to
             take to strengthen their nonproliferation efforts. These efforts included,
             among other things, (1) focusing on improving security; (2) accounting for
             and consolidating HEU and plutonium; and (3) ensuring that the

              We conducted site visits at hospitals and medical facilities in California, Maryland, New
             York, Pennsylvania, Tennessee, Texas, Virginia, and the District of Columbia. We also
             interviewed regulatory officials from Alabama, Arizona, Arkansas, California, Colorado,
             Florida, Kentucky, Maryland, Massachusetts, Mississippi, New Mexico, New York, North
             Carolina, Pennsylvania, Rhode Island, Tennessee, Texas, Virginia, Washington, and

             Page 4                                                                         GAO-12-512T
International Atomic Energy Agency (IAEA) has the necessary resources
to carry out its nuclear security activities. 5

The 2010 Summit produced results. For example, Ukraine announced at
the Summit that it would ship approximately 236 pounds of HEU and 123
pounds of spent nuclear fuel to Russia by the end of 2012. 6 During the
Summit, the United States, Canada, and Mexico announced a new
agreement that calls for the conversion of HEU fuel at Mexico’s nuclear
research reactor to low enriched uranium. Malaysia, Egypt, and Armenia
planned to enact new export control laws to limit nuclear trafficking.
Malaysia, an important hub in the A.Q. Khan illicit nuclear trafficking
network, approved a new export law curbing transfers of nuclear
weapons-related materials. Many other nations expressed their support to
funding efforts for international nuclear safety organizations. For example,
Belgium, Japan, the United Kingdom, Norway, and New Zealand all
pledged funding efforts towards IAEA’s Nuclear Security Fund. 7

 The International Atomic Energy Agency is an independent organization based in Vienna,
Austria, that is affiliated with the United Nations and has the dual mission of promoting the
peaceful uses of nuclear energy and verifying that nuclear technologies and materials
intended for peaceful purposes are not diverted to weapons development efforts. As of
February 2012, the agency had 153 member states. We have recently begun a review of
IAEA programs and activities at the request of this subcommittee.
 In February 2012, NNSA officials told us that the Summit process has accelerated U.S.
efforts to remove HEU from several countries. Specifically, since the 2010 Summit, NNSA
has worked with international partners to remove 380 Kg of HEU from civilian sites in
seven countries: Belarus, the Czech Republic, Kazakhstan, Poland, Serbia, South Africa,
and Ukraine.
 IAEA’s Nuclear Security Fund supports the agency’s efforts to assist countries in
protecting their nuclear and radiological materials and facilities. For more information, see
GAO, Nuclear Nonproliferation: IAEA Has Strengthened Its Safeguards and Nuclear
Security Programs, but Weaknesses Need to Be Addressed, GAO-06-93 (Washington,
D.C.: Oct. 7, 2005).

Page 5                                                                          GAO-12-512T
                         In December 2010, we reported on aspects of U.S. planning and
Governmentwide           strategies to secure all vulnerable nuclear materials worldwide within a 4-
Strategy to Implement    year period. 8 Following President Obama’s announcement of the 4-year
the President’s 4-Year   initiative, NSC took the lead in coordinating efforts among different federal
                         agencies that will contribute to the initiative. NSC officials approved a
Global Nuclear           U.S. governmentwide strategy entitled “Interagency Efforts to Improve the
Material Security        Security of Nuclear Weapons and Fissile Materials,” which, among other
                         things, described the scope and objectives of the interagency effort and
Initiative Lacked        identified the main activities by agencies and programs in support of the
Important Details        President’s initiative. U.S. agencies—including NNSA, DOD, and State—
                         had identified individual plans describing how they intend to contribute to
                         the 4-year initiative. NNSA, for example, had developed a formal written
                         plan with specific details regarding how it intends to contribute to the 4-
                         year nuclear material security goal. The NNSA plan details a prioritized
                         five-part effort, including (1) continuing nuclear security cooperation,
                         especially nuclear material protection, control and accounting (MPC&A)
                         upgrades and efforts to transition responsibility for sustaining MPC&A
                         systems; 9 (2) expanding nuclear security cooperation with other
                         countries; (3) accelerating nuclear material removal with other countries;
                         (4) strengthening nuclear security standards, practices, and next-
                         generation nuclear safeguards; and (5) building international capabilities
                         to prevent illicit nuclear trafficking and smuggling.

                         Despite individual agency efforts to implement the 4-year initiative, we
                         found that the overarching interagency strategy coordinated by NSC
                         lacked specific details concerning how the initiative would be
                         implemented, including the identity of, and details regarding, vulnerable
                         foreign nuclear material sites and facilities to be addressed, agencies and
                         programs responsible for addressing each site, planned activities at each
                         site, potential challenges and strategies for overcoming these challenges,
                         anticipated timelines, and cost estimates. NSC officials told us that
                         developing a single, integrated cross-agency plan that incorporates all
                         these elements could take years. However, we found that, absent such

                          GAO, Nuclear Nonproliferation: Comprehensive U.S. Planning and Better Foreign
                         Cooperation Needed to Secure Vulnerable Nuclear Materials Worldwide, GAO-11-227
                         (Washington, D.C.: Dec. 15, 2010).
                          NNSA’s MPC&A program works to improve the security of nuclear warheads and
                         materials in Russia and at nuclear sites in other countries, consolidate and convert
                         weapon-usable nuclear material stocks, and enable Russia and other countries to sustain
                         MPC&A upgrades over the long term without continued U.S. support.

                         Page 6                                                                     GAO-12-512T
an implementation plan, essential details associated with the 4-year
initiative were unclear, including the initiative’s overall estimated costs,
time frames, and scope of work. For instance, we reported that the costs
of implementing the initiative were unknown. Among other things, NSC
officials told us that estimating the costs associated with the President’s
goal is impossible because the initiative is predicated on having other
countries provide assistance and share costs, and it is impossible to
forecast cooperation that may occur with other countries, including the
resumption of denuclearization efforts in North Korea.

We also found that the time frames for the initiative are uncertain because
NSC officials did not consider the 4-year time frame to be a hard and fast
deadline. Rather than achieving a specific level of nuclear material
security around the world within the 4-year time frame, the President’s
proposal has value in broader terms, according to NSC officials. They
described the value of the President’s proposal as a “forcing function” to
(1) accelerate ongoing U.S. nuclear nonproliferation programs, (2) drive
closer integration of nuclear nonproliferation programs across the federal
government, and (3) mobilize greater international responsibility for and
commitment to nuclear material security. Furthermore, we reported that
other details relating to the overall scope of the 4-year initiative were
vague. For example, we were unable to identify the scope of nuclear
material worldwide that would be addressed under the initiative, because
such details were not included in the interagency strategy document. We
also identified concerns with how the initiative intends to address sites
with potentially vulnerable nuclear materials located in countries that may
impose access limitations that could complicate or preclude U.S. security

We recommended that NSC lead and coordinate the development of a
comprehensive plan for implementing this initiative. Such a plan, in our
view, should clearly identify the specific foreign countries, sites, and
facilities, where materials have been determined to be poorly secured,
and include information specifying the agencies and programs
responsible for addressing each location; planned activities, potential
implementation challenges, and steps needed to overcome those
challenges at each location; and estimated time frames and costs
associated with achieving the 4-year goal. NSC did not comment on our

Page 7                                                            GAO-12-512T
                        Improving the U.S. government’s management of nuclear cooperation
U.S. Agencies Have      agreements could contribute to the administration achieving its goal of
Limited Ability to      securing all vulnerable nuclear material worldwide in 4 years. 10 The
Account for, Monitor,   United States has exported special nuclear material, including enriched
                        uranium, and source material such as natural uranium under these
and Evaluate the        framework agreements for many years. These agreements must contain
Security of U.S.        certain obligations that govern, among other things, the U.S. rights of
                        approval over the transfer, retransfer, enrichment, and reprocessing of
Nuclear Material        certain kinds of nuclear materials transferred from the United States and,
Overseas                in some cases, produced overseas. Partners are required to guarantee
                        the physical protection of U.S. nuclear materials. In September 2011, we
                        issued a report that (1) assessed U.S. agency efforts to account for U.S.
                        nuclear material overseas, (2) assessed DOE and U.S. agencies’ efforts
                        to evaluate the security of these materials, and (3) described DOE’s
                        activities to secure or remove potentially vulnerable U.S. nuclear material
                        at partner facilities. 11

                        We found that U.S. agencies—DOE, NRC, and State—are not able to
                        fully account for U.S. nuclear material overseas that is subject to the
                        terms of nuclear cooperation agreements because (1) the agreements do
                        not stipulate systematic reporting of such information, and (2) there is no
                        policy to pursue or obtain such information. These agreements generally
                        require that partners report inventory information upon request. However,
                        the agencies have not systematically sought such information.
                        Specifically, DOE and NRC do not have a comprehensive, detailed
                        current inventory of U.S. nuclear material—including weapon-usable
                        material—that is located overseas. In addition, NRC and DOE could not
                        fully account for the location and disposition of U.S. HEU overseas in

                          The United States has 27 nuclear cooperation agreements in force for peaceful civilian
                        cooperation with partners, including foreign countries, the European Atomic Energy
                        Community (EURATOM), IAEA, and Taiwan. Governmental relations between the United
                        States and Taiwan were terminated on January 1, 1979. All agreements concluded with
                        the authorities on Taiwan prior to January 1, 1979, are administered for the United States
                        by the American Institute in Taiwan, a nonprofit corporation based in Washington, D.C.
                        The United States has two nuclear cooperation agreements with Australia, including one
                        for Separation of Uranium Isotopes by Laser Excitation technology, bringing the total
                        number of agreements to 27.
                          GAO, Nuclear Nonproliferation: U.S. Agencies Have Limited Ability to Account for,
                        Monitor, and Evaluate the Security of U.S. Nuclear Material Overseas, GAO-11-920
                        (Washington, D.C.: Sept. 8, 2011).

                        Page 8                                                                        GAO-12-512T
response to a 1992 congressional mandate. 12 The January 1993 report
that NRC produced in response to the mandate stated that it was not
possible to reconcile this information from available U.S. sources of data
with all foreign holders of U.S. HEU within the 90-day period specified in
the act. Our analysis of other documentation associated with the report
shows that NRC, in consultation with U.S. agencies, was able to verify the
location of 1,160 kilograms out of 17,500 kilograms of U.S. HEU
remaining overseas as of January 1993. According to DOE and NRC
officials, no further update to the 1993 report was issued, and the U.S.
government has not subsequently attempted to develop such a
comprehensive estimate of the location and status of U.S. HEU overseas.

Nuclear cooperation agreements do not contain specific access rights
that enable U.S. agencies to monitor and evaluate the physical security of
U.S. nuclear material overseas, and the United States relies on its
partners to maintain adequate security. In the absence of access rights,
DOE, NRC, and State have conducted physical protection visits, when
permitted, to monitor and evaluate physical security conditions of U.S.
nuclear materials at overseas facilities. However, we found that the
agencies have not systematically visited countries believed to be holding
the most sensitive material or systematically revisited facilities not
meeting international physical security standards in a timely manner. U.S.
interagency teams made 55 visits from 1994 through 2010 and found that
countries met IAEA security guidelines approximately half of the time.

There are several countries that have U.S. nuclear material that are
particularly problematic and represent special cases for concern.
Specifically, U.S. nuclear material has remained at sites in three countries
where physical protection measures are unknown or the sites have not
been visited by an interagency physical protection team in decades.
DOE’s Global Threat Reduction Initiative (GTRI) removed a large quantity
of U.S.-spent HEU recently from one of those countries. However,
according to NRC and State officials, U.S. transfers to these three
countries were made prior to 1978, when a requirement that the partner
countries guarantee that they will maintain adequate physical security for
transferred nuclear material was added to the U.S. Atomic Energy Act of
1954. Therefore, these countries have not made the same commitments

 Energy Policy Act of 1992, Pub. L. No. 102-486, § 903(b), 106 Stat. 2776, 2945-46.

Page 9                                                                     GAO-12-512T
regarding the physical security of U.S.-transferred material as the United
States’ other nuclear cooperation agreement partner countries.

We also found that physical security concerns are not confined to
countries that have limited infrastructure and resources. The potential
vulnerability of nuclear material at certain facilities in high-income
countries was raised to us by NSC officials. 13 Specifically, we reported
that there may be security vulnerabilities in certain high-income countries,
including three specific high-income countries. For sites in these
countries, GTRI officials told us the U.S. government’s strategy is to work
bilaterally with the countries, provide recommendations to improve
physical protection, and follow up as needed.

In our September 2011 report, we found that DOE has taken steps to
improve security at a number of facilities overseas that hold U.S. nuclear
material but faces constraints. DOE’s GTRI program removes U.S.
material from vulnerable facilities but can only repatriate materials that
have an approved disposition pathway and meet the program’s eligibility
criteria. GTRI officials told us that of the approximately 17,500 kilograms
of HEU exported from the United States, 12,400 kilograms are currently
not eligible for return to the United States. The vast majority of this
amount—about 10,000 kilograms—is currently not eligible for return
because the material does not have an acceptable disposition pathway,
such as permanent disposal or potential reuse. Another 2,000 kilograms
of material is located primarily in the European Atomic Energy Community
(EURATOM) member countries and is in use or adequately protected,
according to GTRI officials. 14

As a result, we made several suggestions and recommendations to
improve oversight and accountability. For example, we suggested that
Congress consider directing DOE and NRC to compile an inventory of
U.S. weapon-usable nuclear materials overseas. As a separate matter,
we also suggested that Congress consider amending the Atomic Energy
Act if State, working with other U.S. agencies, does not include enhanced
measures regarding physical protection access rights in future and
renewed agreements, so that U.S. interagency physical protection teams
may obtain access when necessary to verify that U.S. nuclear materials

 EURATOM is composed of the 27 countries of the European Union.

Page 10                                                           GAO-12-512T
                    have adequate physical protection. We also recommended that the
                    Secretary of State, working with the Secretary of Energy and the
                    Chairman of the NRC, establish better inventory reporting and
                    reconciliation procedures, particularly when it comes to foreign facilities
                    holding U.S. weapon-usable material.

                    DOE, NRC, and State generally disagreed with our recommendations
                    when commenting on our draft report, including the need to reconcile
                    inventories with partner countries, stating that these reconciliations were
                    unnecessary. State believes that implementing the recommendations,
                    generally, would adversely impact U.S. commercial competitiveness in
                    overseas markets and diminish U.S. influence to advance our
                    nonproliferation objectives and cost jobs at home. DOE, however, now
                    agrees in principle with several recommendations we directed to that
                    agency according to a January 24, 2012, letter to us. For example, we
                    recommended, among other things, that DOE, working with its
                    interagency partners, develop formal goals and a systematic process to
                    determine which foreign facilities to visit for future interagency physical
                    protection visits. DOE informed us in the January 2012 letter that it is
                    working with NRC, State, and other agencies to develop a new
                    methodology and improve their efforts to set priorities for U.S. interagency
                    physical protection visits. To that end, DOE has established regular
                    interagency conference calls to coordinate upcoming visits and directed a
                    national laboratory to establish a repository of information regarding past
                    physical protection visits to assist in determining which sites to visit in the
                    future and in what time frame to do so.

                    Reducing the risks posed by vulnerable nuclear material worldwide
Agencies Face       requires a layered approach to protecting such material. As a first layer of
Challenges in       defense, the United States has helped countries secure nuclear materials
                    in place at civilian and defense facilities. As a second line of defense, the
Coordinating U.S.   United States has also helped countries improve their border security to
Efforts to Combat   address the threat posed by nuclear smuggling. According to IAEA, there
                    were 2,164 confirmed cases of illicit trafficking in nuclear and radiological
Nuclear Smuggling   materials worldwide from 1993 through 2011.

                    Page 11                                                            GAO-12-512T
In December 2011, we reported on issues relating to the coordination of
U.S. programs involved in combating nuclear smuggling overseas. 15 We
reviewed 21 federal programs and offices under five federal agencies—
NNSA, DOD, State, DHS, and the Department of Justice. These
programs (1) conduct research and development on radiation detection
technologies, (2) deploy radiation detection equipment along foreign
borders and points of transit, (3) train and equip foreign customs and
border security officials to identify and interdict illicit nuclear materials or
technology transfers, (4) assist foreign governments in the development
of export control systems, (5) enhance and coordinate with foreign
antismuggling law enforcement and prosecutorial capabilities, and (6)
analyze potential foreign nuclear smuggling cases and incidents.

However, we found impediments to the coordination of U.S. efforts to
combat nuclear smuggling overseas. Specifically, we found that none of
the existing strategies and plans for coordinating federal efforts to prevent
and detect nuclear smuggling and illicit nuclear transfers overseas
incorporate all of the desirable characteristics of national strategies, such
as identifying the financial resources needed and monitoring mechanisms
to be used to determine progress and make improvements. For example,
the 2010 Global Nuclear Detection Architecture Strategic Plan—developed
jointly by DHS, DOD, Energy, State, Justice, the intelligence community,
and NRC—did not identify the financial resources needed to achieve the
strategic plan’s objectives or the monitoring mechanisms that could be
used to determine programmatic progress and needed improvements.

We also identified potential fragmentation and overlapping functions
among some programs. Specifically, we identified six programs that
provide training to improve the capabilities of foreign border security and
customs officials to prevent smuggling and illicit nuclear shipments: (1)
NNSA’s Second Line of Defense program, (2) International
Nonproliferation Export Control Program, and (3) Cooperative Border
Security Program, 16 (4) State’s Export Control and Related Border

 GAO, Nuclear Nonproliferation: Action Needed to Address NNSA’s Program

Management and Coordination Challenges, GAO-12-71 (Washington D.C.:
Dec. 14, 2011).
  The Cooperative Border Security Program was an independent program at the time of
our review on the coordination of federal programs involved in combating nuclear
smuggling overseas. However, the program is no longer an independent program, and its
functions were merged into the International Nonproliferation Export Control Program in
June 2010.

Page 12                                                                    GAO-12-512T
Security program, (5) DOD’s Weapons of Mass Destruction-Proliferation
Prevention Program, and (6) International Counterproliferation Program.
Similarly, we identified four programs that are involved in providing
equipment to foreign governments to enhance the ability of their customs
and border security organizations to detect nuclear smuggling: (1)
NNSA’s Second Line of Defense program, (2) State’s Export Control and
Related Border Security program, (3) DOD’s Weapons of Mass
Destruction-Proliferation Prevention Program, and (4) DOD’s International
Counterproliferation Program. In prior reports on nuclear nonproliferation
programs, we have found that consolidating programs that share common
goals and implement similar projects can maximize limited resources and
may achieve potential cost savings or other programmatic and
administrative efficiencies.

Agency officials representing these programs told us that not all of them
have the same focus, that some concentrate on specialized niches, and
that many are complementary. For instance, regarding the provision of
equipment, NNSA, State, and DOD officials noted that the Second Line of
Defense program tends to provide larger equipment, such as radiation
portal monitors and cargo scanning equipment, while the Export Control
and Related Border Security Program and International
Counterproliferation Program provide smaller-scale equipment, such as
hand-held radiation detection pagers, hazardous materials kits, and
investigative suits to foreign customs and border security organizations.
Nevertheless, in our view, the fragmented and overlapping nature of the
programs raise questions as to whether greater efficiency could be
obtained through possible consolidation of such efforts.

Furthermore, we found that no single federal agency has lead
responsibility to direct federal efforts to prevent and detect nuclear
smuggling overseas. In the past, we have reported that interagency
undertakings can benefit from the leadership of a single entity with
sufficient time, responsibility, authority, and resources needed to ensure
that federal programs are based upon a coherent strategy and are well
coordinated, and that gaps and duplication in capabilities are avoided. 17
For instance, State and DOD officials told us that neither State nor any

  See GAO, Combating Terrorism: Selected Challenges and Related Recommendations,
GAO-01-822 (Washington, D.C.: Sept. 20, 2001); and Biosurveillance: Efforts to Develop
a National Biosurveillance Capability Need a National Strategy and Designated Leader,
GAO-10-645 (Washington, D.C.: June 30, 2010).

Page 13                                                                    GAO-12-512T
other federal agency has the authority to direct the activities or coordinate
the implementation of programs administered by other agencies involved
in preventing or detecting nuclear smuggling overseas.

Regarding interagency coordinating mechanisms, NSC has established
mechanisms to coordinate efforts in this area, including a Countering
Nuclear Threats Interagency Policy Committee (IPC) and a sub-IPC for
international nuclear and radiological border security efforts. NSC officials
declined our request to discuss various aspects of the IPC structure and
how it coordinates U.S. efforts to combat nuclear smuggling overseas.
However, some officials from other agencies expressed doubts about the
value of NSC’s coordinating role. Notably, DOD officials told us that they
believed NSC has played a negligible role in coordinating programs to
counter nuclear smuggling.

We made two recommendations to NSC to streamline and eliminate the
potential for fragmentation and overlap among U.S. government
programs involved in preventing and detecting the smuggling of nuclear
materials overseas. Specifically, we recommended that NSC undertake or
direct an appropriate agency or agencies to conduct a comprehensive
review of the structure, scope, and composition of agencies and
programs across the federal government involved in such efforts. Such a
review should include, among other things, (1) the level of overlap and
duplication among agencies and programs and (2) potential for
consolidation to fewer programs and agencies. Following this review, new
guidance should be issued that incorporates the elements of effective
strategic plans, including clearly delineating the roles and missions of
relevant programs, specific priorities, performance measures, overall
program costs, and projected time frames for program completion. NSC
did not respond to these recommendations.

Page 14                                                           GAO-12-512T
                      In 2007, we issued a report at the Subcommittee’s request focusing on the
Agencies Have Taken   security of radiological sources overseas. 18 In the course of that work we
Steps to Secure       visited a number of hospitals and medical facilities in foreign countries and
Domestic              identified weaknesses in security. For example, in one country the security
                      cable used to secure a teletherapy machine’s cobalt-60 source had been
Radiological          broken for almost a month. In another country, we observed that a storage
Materials, but Gaps   facility containing devices with thousands of curies of cesium-137 had
                      several unsecured large openings in the roof. Based on the findings in this
Remain                report, the Subcommittee subsequently asked us to review the security of
                      hospitals and medical facilities in the United States that use radiological
                      sources. Hospitals and medical facilities in the United States are significant
                      users of radiological sources contained in medical devices used primarily
                      for cancer treatment and research. The amount of radiation emitted by the
                      sources in these devices varies according to the size and type of source.
                      For example, teletherapy machines contain a single cobalt-60 source
                      ranging from about 1,000 to 10,000 curies, while irradiators can
                      occasionally contain up to 27,000 curies or more of cesium-137. The
                      following section provides our preliminary findings on our ongoing work.

                        GAO, Nuclear Nonproliferation: DOE’s International Radiological Threat Reduction
                      Program Needs to Focus Future Efforts on Securing the Highest Priority Radiological
                      Sources, GAO-07-282 (Washington, D.C.: Jan. 31, 2007).

                      Page 15                                                                     GAO-12-512T
NRC’s Security            NRC, which is responsible for regulating the security of radiological
Requirements Do Not       sources in U.S. hospitals and medical facilities, issued a security order in
Prescribe Specific        2005 that directed licensees possessing radiological sources of concern
                          to implement increased controls for access, detection and assessment,
Measures for Protecting   material shipments, physical barriers, information protection, and
Radiological Sources at   sensitive information. 19 NRC has relinquished jurisdiction for licensing
Hospitals and Medical     and regulating radiological sources to 37 states called Agreement States,
Facilities                whose offices are typically administered by state health or environment
                          departments, and which inspect licensees to ensure compliance with
                          state regulations that are generally compatible with NRC regulations. The
                          Department of Veterans Affairs and DOD, which maintain a network of
                          hospitals and medical facilities in the United States, are also required to
                          meet the NRC security order for radiological sources of concern at their

                          NRC’s security order and implementation guidance are broadly written
                          and do not prescribe the specific steps that licensees must take to secure
                          their sources. Rather, they provide a general framework for what
                          constitutes adequate security practices. According to NRC, the intent of
                          the increased controls is not to provide absolute security from theft or
                          unauthorized access. Rather, the intent is to develop a combination of
                          people, procedures, and equipment that will delay and detect an intruder,
                          and initiate a response to the intrusion. In addition, the controls provide
                          minimum requirements that a licensee must implement, and licensees
                          may go beyond the minimum requirements. However, the ultimate
                          responsibility for securing radiological materials in the United States rests
                          with the licensees that possess these materials.

                             A licensee is a company, organization, institution, or other entity to which the NRC or an
                          Agreement State has granted a general license or specific license to construct or operate
                          a nuclear facility, or to receive, possess, use, transfer, or dispose of source material,
                          byproduct material, or special nuclear material. Security orders contain requirements for
                          licensees to implement, including interim compensatory security measures beyond that
                          currently required by NRC regulations or licenses. Some of the requirements formalize a
                          series of security measures that licensees took in response to advisories NRC issued in
                          the aftermath of the September 11 terrorist attacks. NRC’s regulations impose
                          requirements that licensees must meet in order to use nuclear materials or operate a
                          nuclear facility. NRC has undertaken a rulemaking to promulgate regulations addressing
                          the physical protection of byproduct materials. That rulemaking is currently under review
                          by the Commission.

                          Page 16                                                                         GAO-12-512T
The security order directs that licensees limit access to radiological
sources and develop a documented program to detect, assess, and
respond to unauthorized access. The controls do not prescribe the types
of physical security needed. It is up to the licensee to determine, for
example, if security cameras are necessary or what types of locks or
alarms are needed to secure doors or windows. For some locations, such
as blood banks, requirements for access control can be met if the room
where the medical device is located is staffed 24 hours a day, 7 days a
week by an individual, or individuals, who are determined to be
trustworthy and reliable. As long as the room is staffed at all times, the
facility is not required to have any additional physical security, such as
cameras or motion detection equipment. As a result, the only access
control in place could be one or more staff members.

NRC also requires that hospitals and medical facilities verify the
trustworthiness and reliability of individuals who are granted unescorted
access to the medical devices containing radiological sources. The
trustworthiness and reliability process requires that hospitals conduct a
background check using information such as employment history,
academic records, and other relevant information. It is ultimately the
responsibility of the licensee to decide whether to grant the employee
unescorted access. In 2007, NRC issued an additional security order
requiring individuals employed at facilities containing highly radioactive
sources to undergo fingerprinting with verification through the Federal
Bureau of Investigation.

According to NRC officials, the requirements are intentionally broad to
allow licensees flexibility to tailor security upgrades to their specific facility
and operations. The ability to tailor security to a facility’s needs and
resources is particularly important for commercial facilities with limited
resources. For example, officials from smaller medical facilities told us
that implementing specific security requirements—such as cameras and
other surveillance equipment—could jeopardize their continued
operations because of the costs associated with this equipment. NRC
officials told us that given factors such as diverse economic conditions,
facility type, layout, and operations of facilities, a “one size fits all”
approach is neither practical nor desirable.

We found that the NRC controls have been implemented in a variety of
ways in the hospitals and medical facilities we visited in seven states and
District of Columbia. These approaches have created a mix of security
controls and procedures that could leave some facilities’ radiological
sources more vulnerable than others to possible tampering, sabotage, or

Page 17                                                               GAO-12-512T
outright theft. At some locations, the controls resulted in significant
security upgrades, such as the addition of surveillance cameras,
upgrades to locks on doors, and alarms. In contrast, we observed minimal
security in other facilities. Moreover, law enforcement personnel from
states with significant amounts of high-activity radioactive sources at
hospitals and medical facilities told us that the NRC controls have an
inherent weakness: the controls do not specify what the facility is
protecting against and are not linked to a design basis threat. 20 Typically,
a design basis threat characterizes the elements of a potential attack,
including the number of attackers, their training, and the weapons and
tactics they are capable of employing. Although NNSA does not use a
design basis threat for its security assessments of hospitals and medical
facilities, it does employ a threat scenario (known as potential adversary
capability) as the basis for its recommendations for security
enhancements. According to a VA official, VA initially developed a generic
threat scenario for use at its facilities with larger activity sealed
radiological sources since NRC did not provide a design basis threat as
part of the increased controls. Later, VA partnered with NNSA to
implement security enhancements based on the NNSA threat scenario.

All of the 25 medical facilities we visited have implemented the controls
and undergone inspections by either NRC or Agreement State inspectors,
but we observed a number of potential security weaknesses. 21 For

•    At a hospital in one state, two cesium-137 research irradiators using
     approximately 2,000 curies and 6,000 curies, respectively, are housed
     in the basement of a building that is open to the public. The hallway
     leading to the irradiator room has a camera, but it is pointed away

  NRC noted that, according to IAEA’s Nuclear Security Series Implementation Guide No.
11, “Security of Radioactive Sources,” the design and evaluation of a security system
should take into account the current national threat assessment and may include the
development and application of a design basis threat, although it is not required.
According to IAEA, a design basis threat includes the attributes and characteristics of a
potential insider and/or external adversaries, who might attempt unauthorized removal or
sabotage, against which a physical protection system is designed and evaluated.
  The 25 sites we visited are a non-generalizable sample, selected on the basis of the
number of radiological devices in the state and the total number of cumulative curies
contained in these devices in each state. In addition, we also considered if the site had
undergone security upgrades funded by NNSA, and if the site is located in a large urban

Page 18                                                                       GAO-12-512T
    from the room. The door to the room is opened by a swipe card lock,
    and there are no cameras or other security measures inside the room.
    We observed that one of the irradiators was sitting on a wheeled
    pallet. When we asked the radiation safety officer (RSO)—the
    designated hospital official responsible for the security of radiological
    sources—if he had considered removing the wheels, he said no. This
    response was given even though the irradiator room is located in
    close proximity to an external loading dock, and the cameras along
    the corridor to the loading dock are displayed on a single monitor.
    This facility had passed its most recent NRC security inspection
    because access to the room where the irradiators were located was
    restricted through use of a swipe card. However, it could be
    vulnerable because of the limited security we observed and the
    potential mobility of the device.

•   At a hospital in a major U.S. city, we observed that the interior door to
    the hospital blood bank, which had a cesium-137 blood irradiator of
    approximately 1,500 curies, had the combination to the lock written on
    the door frame. The door is in a busy hallway with heavy traffic, and
    the security administrator for the hospital said that he often walks
    around erasing door combinations that are written next to the locks.
    According to NRC, a single lock is not necessarily a security
    weakness, however, they noted that writing combinations on the door
    is a weakness.

•   The RSO at a university hospital in another state told us that he did
    not know the exact number of individuals with unescorted access to
    the hospital’s radiological sources, although he said that there were at
    least 500 people—the current data system does not allow for entering
    records of individuals beyond 500. In the past, he said, the hospital
    had as many as 800 people with unescorted access to sources. In
    contrast, at a major medical research facility at a military installation
    we visited, access was limited to 4 safety and security personnel.

•   At a blood center in a third state we visited, we observed a cesium-
    137 blood irradiator of approximately 1,400 curies in a room that was
    secured by a conventional key lock. The irradiator was located in the
    middle of the room and not secured to the floor. The room had an
    exterior wall with a bank of unalarmed and unsecured windows that
    looked out onto a loading dock. The blood center officials said that
    while they met the controls, they acknowledged that the center is
    highly vulnerable to theft or sabotage of their radiological sources.
    According to NRC, an irradiator sitting in the middle of the floor not
    bolted down is not necessarily vulnerable.

Page 19                                                           GAO-12-512T
Licensees are responsible for implementing the security requirements,
including designing a security plan and implementing it. Implementation
includes procuring and installing surveillance and alarm equipment that
the licensees believe is adequate to protect the radiological materials in
their facilities. However, many of the officials at the 25 hospitals and
medical facilities we visited told us that they have backgrounds in
radiological safety and facilities management and have limited security
experience. Furthermore, none of these officials has been trained in how
to implement the controls. For example:

•    At another hospital we visited, the RSO said that when the controls
     were instituted in 2005, his new responsibilities included ensuring the
     security of a cobalt-60 gamma knife of approximately 2,600 curies and
     a cesium-137 blood irradiator of about 2,400 curies. He told us that he
     was not comfortable with his security role because his training was as
     a health physicist. 22

•    One facility manager who oversees the security for an approximately
     1,700 curie cesium-137 blood irradiator at a blood bank told us that he
     has a background in construction, not security. He said that it would
     have been helpful if NRC’s controls were more specific so that he
     would be in a better position to determine what security measures
     were necessary to adequately protect the device.

According to NRC, NRC and Agreement State inspectors receive training
in security inspections. They also noted that only qualified inspectors can
conduct security inspections. Qualification includes training and
inspection accompaniments with qualified inspectors. However, some
inspectors from NRC and Agreement States we interviewed told us that
they do not feel comfortable conducting security inspections at hospitals
and medical facilities, despite having received this training. For example,
an NRC inspector said that security inspections were particularly difficult
for her because she is trained as a physicist. She said that the controls
were confusing, and she did not understand the nuances of security. An
Agreement State inspector from another state we visited also told us that
he was not qualified to do security inspections. However, he said that he

  Health physics is a science concerned with recognizing and evaluating the effects of
radiation on the health and safety of people and the environment, monitoring radiation
exposure, and controlling the associated health risks and environmental hazards to permit
the safe use of technologies that produce radiation.

Page 20                                                                      GAO-12-512T
                             was doing the best he could to interpret the controls and help the
                             licensees implement the requirements. Other inspectors from this state
                             told us that they were placed in the awkward situation of having to
                             enforce regulations that they did not believe they were fully qualified to

                             We also found that Agreement States lacked sufficient staff and adequate
                             training to ensure the security of radiological sources, according to recent
                             NRC reviews of two Agreement States’ inspection programs. 23 For
                             example, NRC’s review of one of the state’s radioactive materials
                             program found that the program experienced significant turnover and that
                             inspectors did not have an adequate understanding of the controls.
                             According to a state official, high staff turnover and the resulting lack of
                             security experience affected the quality of their oversight. As a result,
                             inspectors had difficulty assessing licensee compliance with the security
                             requirements. According to NRC’s review of the other state’s radioactive
                             materials program, the state’s newer inspectors would have benefitted
                             from additional training on NRC’s security requirements. A state inspector
                             told NRC that he did not understand the meaning of some of the
                             documentation he was reviewing. Another state official stated that he was
                             authorized to inspect a radiological device independently (without being
                             accompanied by a more experienced inspector) before he was ready to
                             do so. Furthermore, according to state officials, staff turnover has
                             significantly affected the state’s timely follow-up of increased controls
                             violations. NRC told us that they plan, based on the findings of these
                             reviews, to take action in future reviews to remedy these problems.

NNSA Has Secured             According to NNSA, there are approximately 1,500 hospital and medical
Radiological Sources at      buildings in the United States —that they have identified—that contain
U.S. Hospitals and Medical   high-activity radiological sources. NNSA also estimates that these
                             buildings cumulatively contain about 22 million curies of radioactive
Facilities                   material. 24 One of GTRI’s components is the Domestic Material Protection

                                NRC’s Integrated Materials Performance Evaluation Program reviews Agreement State
                             programs to ensure that they meet NRC’s standards. Since 2006, NRC has conducted 41
                             reviews that contained reports on state’s performance regarding the inspection and
                             licensing of the increased controls. Of the 41 reviews, 4 noted problems with how the state
                             was implementing the increased controls.
                               According to NNSA, this estimate reflects the amount of curies for the licensed
                             maximum for each device. It does not reflect what the actual amount of curies may be,
                             because curie levels diminish as the device is utilized.

                             Page 21                                                                       GAO-12-512T
program, which further improves security beyond NRC and Agreement
State regulatory requirements at U.S. facilities with high-activity
radiological sources, including hospitals and medical facilities. 25 This
voluntary program provides, among other things, U.S. hospitals with
security upgrades to the devices that contain high-activity radiological
sources. It also provides training for hospital personnel and local police
departments through its Alarm Response Training program at the Y-12
National Security Complex in Oak Ridge, Tennessee. This training is
designed to teach facility personnel and local law enforcement officials
how to protect themselves and their communities when responding to
alarms indicating the possible theft or sabotage of nuclear or radioactive
materials. NNSA funds the cost of the security upgrades and training.
However, the licensee is responsible for maintaining the security systems
once the 3-to-5-year warranty period established by NNSA expires.
NNSA officials told us that they estimated the average cost of maintaining
the upgrades at each hospital was typically less than $10,000 per year.

According to NNSA officials, as of December 2011, the program spent an
estimated $96 million to secure radiological sources at 302 U.S. hospitals
and medical facilities. The program plans to complete voluntary security
upgrades at all 1,503 hospital and medical buildings it has identified as
high-risk by 2025, at a projected cost of $608 million. NNSA officials told
us that they estimate the average cost to upgrade a medical building has
been $317,800. 26 We plan to analyze these expenditures more fully
during the course of our review. 27

Of the 25 hospital and medical facilities that we visited in seven states
and the District of Columbia, 13 have received GTRI upgrades and three
were in the process of receiving the upgrades. Officials from most of the
16 hospitals and medical facilities told us that GTRI’s program enhanced
the security of their facilities. We observed a number of security upgrades
at the facilities we visited, including remote monitoring systems,
surveillance cameras, hardened doors, iris scanners, motion detectors,
and tamper-proof alarms. NNSA has established criteria for determining

  The upgrading of hospitals and medical facilities is one component of GTRI’s Domestic
Material Protection program, which also secures high-activity radiological sources in other
commercial facilities and sites.
 According to NNSA officials, training costs were excluded from the data.
 These cost estimates are of undetermined reliability.

Page 22                                                                       GAO-12-512T
which hospitals are eligible for assistance; it ranks facilities to be
upgraded based on the relative risk of the radiological sources and
expected risk reduction resulting from the planned GTRI activity. The
criteria NNSA uses include the following: the attractiveness for theft or
diversion of nuclear and radiological materials; existing site security
conditions; threat environment; and location to a potential target, such as
a large population center.

Some hospital officials and police department personnel told us that the
GTRI program is limited because it is a voluntary program and because of
the potential financial burden placed on hospitals and medical facilities to
maintain the upgrades beyond the 3- to 5-year warranty period. We found
that some hospitals have declined the upgrades, including hospitals
located in high-risk urban areas. For example:

•   At a blood bank in one of the states we visited with a cesium-137
    blood irradiator of approximately 1,400 curies, staff told us that NNSA
    was prepared to upgrade the bank’s security, but the blood bank
    decided not to participate because senior management wanted to wait
    until the blood bank moved to a new location, which it planned to do
    within the next 3 years. We observed that the blood irradiator
    appeared vulnerable—it was visible through an unalarmed and
    unsecured bank of windows overlooking an exterior loading dock. In
    February 2012, we contacted NNSA officials about this matter. As a
    result, NNSA and national laboratory officials met with the facility and
    developed a plan to secure the irradiator before the end of the fiscal

•   According to police department officials from one major U.S. city, one
    hospital with a blood irradiator of approximately 1,700 curies has
    declined the GTRI upgrades, even though the police department
    considers it a high-risk facility. The hospital officials told us in
    February 2012 that they decided not to implement the GTRI upgrades
    because of concerns about maintenance costs associated with the
    security equipment after the NNSA-funded warranty period expired.
    The RSO said that the security the hospital has in place is adequate.
    Furthermore, the hospital is under serious budget pressure that
    makes it difficult to justify spending more money on protecting the

Page 23                                                          GAO-12-512T
                   Under the GTRI program, NNSA also upgrades some smaller sources,
                   such as those contained in brachytherapy devices. 28 Typically, these
                   devices contain between 10 and 15 curies of iridium-192. The curie level
                   is not considered high enough to be subject to NRC’s security controls,
                   but NNSA officials told us that the devices’ portability makes them a
                   potential target for theft. NNSA officials stated that GTRI completed
                   security upgrades at some sites before they considered including
                   brachytherapy devices. GTRI is in the process of revisiting these sites
                   and implementing security enhancements. We observed GTRI upgrades
                   for brachytherapy devices at some hospitals, including a device that was
                   put in a locked closet. However, we did visit one GTRI-upgraded facility
                   where the security of the brachytherapy device had not been upgraded. In
                   this facility, there were no security cameras monitoring the area, and in
                   particular, there were no cameras in the room where the device was
                   located. Furthermore, access to the room was controlled by a wooden
                   door with a padlock, and we observed a hospital official retrieve the key to
                   the padlock from an unlocked desk immediately outside the door. Upon
                   entering the room, we observed that the device was not secured to the
                   floor, as required by the hospital’s own security protocol.

                   We are continuing to conduct our audit and plan to visit some additional
                   medical facilities in the United States. We plan to issue our report later
                   this year.

                   Chairman Akaka, Ranking Member Johnson, and Members of the
                   Subcommittee, this completes my prepared statement. I would be
                   pleased to respond to any questions you may have at this time.

                   If you or your staff have any questions about this testimony, please
GAO Contact and    contact me at (202) 512-3841 or aloisee@gao.gov. Contact points for our
Staff              Offices of Congressional Relations and Public Affairs may be found on
                   the last page of this statement. GAO staff who made key contributions to
Acknowledgements   this testimony are Glen Levis, Assistant Director; Jeffrey Barron; Alysia
                   Davis; William Hoehn; Will Horton; and Michelle Munn.

                     A brachytherapy device typically involves inserting radioactive material into the body
                   near the treatment site.

                   Page 24                                                                        GAO-12-512T
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
GAO’s Mission         The Government Accountability Office, the audit, evaluation, and
                      investigative arm of Congress, exists to support Congress in meeting its
                      constitutional responsibilities and to help improve the performance and
                      accountability of the federal government for the American people. GAO
                      examines the use of public funds; evaluates federal programs and
                      policies; and provides analyses, recommendations, and other assistance
                      to help Congress make informed oversight, policy, and funding decisions.
                      GAO’s commitment to good government is reflected in its core values of
                      accountability, integrity, and reliability.

                      The fastest and easiest way to obtain copies of GAO documents at no
Obtaining Copies of   cost is through GAO’s website (www.gao.gov). Each weekday afternoon,
GAO Reports and       GAO posts on its website newly released reports, testimony, and
                      correspondence. To have GAO e-mail you a list of newly posted products,
Testimony             go to www.gao.gov and select “E-mail Updates.”

Order by Phone        The price of each GAO publication reflects GAO’s actual cost of
                      production and distribution and depends on the number of pages in the
                      publication and whether the publication is printed in color or black and
                      white. Pricing and ordering information is posted on GAO’s website,
                      Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                      TDD (202) 512-2537.
                      Orders may be paid for using American Express, Discover Card,
                      MasterCard, Visa, check, or money order. Call for additional information.
                      Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO      Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
                      Visit GAO on the web at www.gao.gov.
To Report Fraud,
Waste, and Abuse in   Website: www.gao.gov/fraudnet/fraudnet.htm
                      E-mail: fraudnet@gao.gov
Federal Programs      Automated answering system: (800) 424-5454 or (202) 512-7470

                      Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-
Congressional         4400, U.S. Government Accountability Office, 441 G Street NW, Room
Relations             7125, Washington, DC 20548

                      Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs        U.S. Government Accountability Office, 441 G Street NW, Room 7149
                      Washington, DC 20548

                        Please Print on Recycled Paper.