Undercover inspectors working for the U.S. Government Accountability Office were able to fool the United States’ top nuclear regulator into granting it licenses to acquire material necessary to build a "dirty bomb," or crude nuclear device, according to a new oversight report.
The GAO concluded in a new oversight report on the Nuclear Regulatory Committee, or NRC, that it had improved security measures, but still has "not taken some measures to better control some dangerous quantities of radioactive material."
As part of a covert GAO test, the accountability agency established several dummy corporations and attempted to procure licenses needed to purchase dangerous radioactive materials, including those needed to build a crude nuclear explosive device.
The accountability agency did not take steps to make it appear as if these dummy corporations were legitimate businesses, according to the report, which showed that the NRC granted a license to the fake organization in one of three test cases.
In each case, the GAO attempted to acquire the licenses needed to purchase increasingly dangerous radioactive materials, the most dangerous of which are known as category 1 materials. The least dangerous materials are dubbed category 3, but all are classifications that include hazardous nuclear substances coveted by terror groups and other criminal outfits.
"GAO's covert testing of NRC requirements showed them to be effective in two out of our three cases," according to the report.
However, "in a third case, GAO was able to obtain a license and secure commitments to purchase, by accumulating multiple category 3 quantities of materials, a category 2 quantity of a radioactive material considered attractive for use in a ‘dirty bomb’—which uses explosives to disperse radioactive material," according to the report.
"In the third case, the official from the regulatory body accepted GAO's assurances without scrutinizing key aspects of the fictitious business, which led to a license being obtained," according to the report.
The findings are particularly concerning as GAO "made no attempt to outfit the [fake business] site to make it appear as if a legitimate business was operating there."
The NRC handed a paper license to an undercover GAO operator during the undercover operation.
"Our application was approved and the paper license was handed to our GAO investigator posing as a representative of our fictitious company at the end of the prelicensing site visit," according to the report.
The NRC also believed several lies by these undercover inspectors.
"During the application process and site visit, the regulatory official accepted our written and oral assurances of the steps that our fictitious company would take—to construct facilities, establish safety procedures, hire sufficient qualified staff, and construct secure storage areas—after receiving a license," the report states.
"The official from the regulatory body accepted our assurances without scrutinizing key aspects of our fictitious business to the extent that the other regulatory bodies had," the report adds.
The GAO was ultimately able to use this license to get commitments to obtain enough category 3 materials to reach a category 2 quantity of radioactive material, which the GAO says is an attractive source for use in building a dirty bomb.
"Once we obtained a license, we were able to exploit the absence of a requirement to verify the legitimacy of category 3 licenses with the appropriate regulatory body and obtained commitments to acquire, by accumulating multiple category 3 sources, a category 2 quantity of radioactive material," the report explains. "Importantly, this material is 1 of the 20 radionuclides that NRC previously determined are attractive for use in an RDD (also known as a dirty bomb)."
"Once we obtained a license, we contacted a vendor of the category 3 radioactive source that we specified on our license application. We provided a copy of the license, among other things, to the vendor and subsequently obtained a signed commitment from this vendor to sell us the source," it continues. "We then altered the paper license and contacted another vendor who also agreed to sell us a category 3 source we specified on our altered license. When combined, these two high-level category 3 sources aggregate to a category 2 quantity of radioactive material."
In the second undercover attempt, the NRC recommended that the fake GAO business take steps to improve its oversight and effectiveness.
"In the second case, officials from the regulatory body stated that we would not receive a license until the site was significantly more developed, consistent with operating as a genuine business, and had installed on-site an appropriately safe and secure storage container for the radiological source and posted requisite safety placards specified in the application, among other things," according to the report.