Energy Probe

Paul Leventhal
Nuclear Control Institute
January 30, 2002

US President says terrorists had diagrams of nuclear power plants;
NRC must move now on major upgrade of security aginst attack

Washington, D.C.—Last night, President Bush disclosed that “diagrams of American nuclear power plants” have been found among the items left by terrorists in Afghanistan, but he failed to announce what measures he will take to prevent these and other plants from being successfully hit, said Paul Leventhal, president of the Nuclear Control Institute.

“Unfortunately, neither the White House nor the Nuclear Regulatory Commission (NRC) have taken protective measures commensurate with the threat or with the unthinkable consequences of a successful attack on one of these plants,” Leventhal continued. “These plants are vulnerable today, and that is intolerable.”

“U.S. nuclear power plants need immediate military protection—the placement of National Guard troops or other military forces in sufficient numbers to provide a visible show of force and a credible deterrent against attack from the land, air or water,” Leventhal said. “Anti-aircraft weapons, under strict rules of engagement and command and control, are also needed as a last-resort measure in the event fighter interceptors cannot catch up with a jumbo jet headed for a suicidal hit on a plant,” he said.

For months, the NRC has been conducting a “top to bottom” review of its security procedures but so far has failed to take any action—-beyond the original heightened state of alert it requested of plant operators on September 11—to require the substantially increased security that is needed now to defeat a large, coordinated attack on a scale of the 9/11 attacks. Thus far, nuclear power plants have assigned some additional guards and patrols, often by having guards work double shifts, and have made use of a few state troopers and National Guard troops. In a number of states, the National Guard troops have since been withdrawn. Despite industry claims that the plants are protected by “well-paid, paramilitary forces,” the guards at some plants are “rent-a-cops” receiving low wages, in some cases less than janitors are paid in these plants.

He noted that current law and regulations do not require the private operators of these plants to defend against “an enemy of the United States,” whether a nation or a person. “It should be obvious,” Leventhal said, “that the U.S. government must step in with military protection or it must be prepared to shut the plants down. Allowing the plants to continue operating with inadequate security, in some cases only tens of miles from major cities like New York, Philadelphia, Cleveland, Chicago, Charlotte and Los Angeles, is unconscionable. Millions of people are at risk in the event of a successful attack causing severe damage to the reactor core or spent fuel pool at these plants.”

Nuclear Control Institute presented a detailed critique of the poor state of nuclear power plant security in testimony, presented jointly with the California-based Committee to Bridge the Gap, on December 5 before the House Committee on Energy and Commerce Subcommittee on Oversight and Investigations [http://www.nci.org/01NCI/12/react-prot.htm]. A new NCI website on nuclear terrorism [http://www.nci.org/nuketerror.htm] presents additional documents on NCI’s 20-year effort to upgrade security at these plants and to reduce other vulnerabilities to terrorists going nuclear.

Due to the NRC’s inaction in the face of a real and growing threat, Senators Reid, Lieberman and Clinton and Representatives Markey and Lowey have introduced legislation which requires an increase in security to meet the new threat and also federalizes the nuclear plant security forces. [http://www.house.gov/markey/iss_terrorism_bill011129.pdf]

Over the past few years, about half of the nuclear power plants have failed mock terrorist attacks in drills supervised by the NRC. In spite of this poor record against a much smaller adversary than the one encountered on September 11, the NRC has taken steps to transfer supervision of these tests to the nuclear industry, a move that will further reduce security preparedness. Despite a need to demonstrate increased preparedness since September 11, the NRC has suspended the tests involving mock attacks, as well as tests of emergency planning around nuclear power plants, and has given no indication when these tests will be reinstated.

The Indian Point nuclear power plant, located just 35 miles north of mid-town Manhattan, has 20 million people living within a 50 mile radius of the plant. “A core meltdown caused by a terrorist attack on the Indian Point plant could cause tens of thousands of cancer deaths and property losses of more than a trillion dollars. “By comparison, the $1 billion a month cited by the President as the cost of the war against terrorism in Afghanistan is peanuts,” Leventhal said. NCI is the principal co-petitioner with the Hudson Riverkeeper in a request that the NRC shut down the Indian Point plant until a major upgrade in security at the plant has been developed and successfully tested.

Suan Q. Stranahan
Mother Jones
January 24, 2002

Security requirements for plants like Pennsylvania’s Three Mile Island have barely changed since the 1970s. About 6 p.m. on October 17, five weeks after the World Trade Center and Pentagon attacks, officials at the federal Nuclear Regulatory Commission (NRC) telephoned the control room at the Three Mile Island nuclear plant near Harrisburg, Pennsylvania, with some chilling information. The intelligence community had intercepted a “credible” threat against the reactor.

As it happened, the plant was in a particularly vulnerable stage of its operating cycle: It had been shut down for refueling and the massive steel cover of the reactor vessel-the final barrier protecting the highly radioactive fuel core-was open. Spent fuel was being moved to a warehouse far less secure than the reactor itself, and hundreds of temporary contractors were swarming about the plant.

While plant operators scrambled to secure the sprawling facility, state and federal law enforcement officials raced to the island. Two nearby airports were ordered shut down and military aircraft were sent aloft to patrol.

By the next morning, the threat was reassessed and deemed “noncredible.” The alert was canceled. Still, the event marked a watershed. For the first time, the nuclear industry had been forced to confront a fact it has actively denied since its earliest days-that its reactors are highly vulnerable to terrorist acts.

For more than 20 years, government auditors and independent watchdogs have warned that an attack resulting in a massive release of radiation could cause tens of thousands of casualties and billions in property damage. Yet despite evidence of widespread security problems at the nation’s nuclear plants, operators and the NRC have downplayed the risk. “The nuclear industry and regulators have engaged in a long process of denial,” says Paul L. Leventhal, president of the Nuclear Control Institute, a Washington public-interest organization.

Within hours of the September 11 attacks, utility officials were telling the public that reactor buildings could withstand the crash of a fully loaded jetliner. Less than two weeks later, the NRC announced that plant designers had, in fact, not “specifically contemplated attacks by aircraft such as Boeing 757s and 767s.” Industry representatives and the NRC ignored suggestions that National Guard troops and antiaircraft weaponry be dispatched to nuclear plants (though the governors of at least eight states have since independently ordered Guard troops to reactors). The Nuclear Energy Institute, an industry lobbying group, assured Americans that “each nuclear plant has a well-armed security force trained to defend against armed assaults and acts of sabotage.”

In fact, the industry’s security record is anything but reassuring. As far back as 1977-two years before the near-meltdown accident at Three Mile Island-the General Accounting Office noted that protection against sabotage at nuclear plants was “at best inadequate.”

NRC documents also show a long history of security lapses at reactors. At one nuclear plant, inspectors found the entry code taped up next to a door buzzer; at others, records were falsified and unauthorized personnel had access to off-limits areas. Perhaps most remarkable, in federal tests designed to assess terrorism preparedness, guards at nuclear plant sites have failed to repel pretend saboteurs almost half the time.

Critics who raise security concerns have long been regarded as “antinuclear or delusional,” says Peter Bradford, who served as an NRC commissioner during the 1979 accident and now lectures on energy policy at Yale University. “The consequences [of sabotage or an accident] are so large and the safeguards so inadequate that the only way to be comfortable is to say it can’t happen. Yet the events of September 11 put what can and canÕt happen in quite a different light.”

Today’s NRC rules require plants to have only five guards trained to repel intruders on duty at any given time. And the attack scenario used to evaluate preparedness has remained unchanged since the mid-1970s: Several (the exact number is classified) intruders arrive on foot, carrying handheld weapons, sometimes with help from an “insider” acting alone. The scenario assumes that the intruders will not be willing to inflict mass casualties, that intelligence agencies will have advance knowledge of the attack, and that there will be no more than one inside supporter. The only modification to the security rule was made in 1994, when the NRC told plant owners to install concrete barriers at their gates. That change came 20 months after a truck bomb severely damaged the World Trade Center.

Even when judged by those limited rules, reactor security forces have frequently failed. In exercises conducted by the NRC between 1992 and 1998, guards at 27 of 57 nuclear plants failed to keep mock intruders from inflicting simulated damage sufficient to put the nuclear core in jeopardy-this despite the fact that reactor owners got 6 to 12 months’ advance notice of the visits, and until recently were allowed to beef up their security staffs to respond to the attacks. (One intruder bypassed the detection system seven times simply by crawling or jumping past a checkpoint.)

The testing program has drawn frequent criticism from industry representatives, who say preparing for the mock raids is too costly. In 1998, the NRC quietly canceled the exercises but reinstated them after protests from citizens groups and a member of Congress. Until September 11, the agency was working on a new plan that would have turned inspections over to the industry. That change is on hold while the NRC conducts a “top to bottom” review of nuclear security, says commission chairman Richard Meserve. The commission has not said when it expects that review to be completed.

But a growing number of nuclear watchdog groups aren’t convinced the NRC will make the required changes on its own. In October, environmentalists petitioned the NRC to re-valuate plans to increase the amount of highly radioactive spent fuel stored at Connecticut’s Millstone reactor: A terrorist attack on the facility, they argued, could trigger a radiation release that would contaminate “thousands of square kilometers of land.” Industry representatives dismissed that scenario as “fantastic.”

Meanwhile, Edward J. Markey, a Massachusetts Democrat who serves on the House Energy and Commerce Committee, has introduced legislation that would require tougher security standards. He also favors use of National Guard troops at all reactors, a move the industry has resisted.

If meaningful improvements are to be made in nuclear security, argues Markey, Congress must demand them. “The nuclear industry believes accidents will not happen, and they’ve extended that mentality now to say that terrorist attacks won’t be successful,” he says. “The threat is real, but they still don’t get it.”

January 23, 2002

Information assessment team advisory update for power reactors, non-power reactors, decommissioning reactors, category I and III fuel facilities, independent spent fuel storage installations, and large material licensees

Subject: update on threat environment — commercial aircraft

FBI headquarters has provided the following information to all field offices. During debriefings of an al Qaeda senior operative, he stated there would (be) a second airline attack in the U.S. The attack was already planned and three individuals were on the ground in the states recruiting non-Arabs to take part in the attack. The plan is to fly a commercial aircraft into a nuclear power plant to be chosen by the team on the ground. The plan including diverting the mission to any tall building if a military aircraft intercepts the plane. No specific timeline or location was given for the attack. As of 1/23/02, one NRC licensee, Columbia Generating Station, had been contacted by their local FBI representative. It is unknown whether other NRC licensee(s) will be contacted as well. FBI headquarters cannot at this time, provide a complete assessment of the credibility of the information. No additional actions are requested in response to this advisory at this time.

In the light of the continuing high level of threat, NRC reaffirms its request that any information regarding threats or suspicious activities should be reported immediately to the NRC operations center, 301-816-6100. This advisory does not supercede any previous advisories presently in effect. You will be advised of any pertinent changes as soon as possible.

Daniel Hirsch
Bulletin of the Atomic Scientists
January 21, 2002

The question immediately arose on September 11 and has persisted: As horrific as the terrorist attacks were, what might have happened if the terrorists who seized jumbo jets and used them as weapons against the World Trade Center and the Pentagon had aimed them at nuclear power plants instead? And if more attacks are likely, as government officials have said, are nuclear facilities on the terrorist target list?

The Sunday Times of London reported in October that some intelligence assessments suggest that the intended target of the fourth plane, the one downed in Pennsylvania, was a nuclear power reactor. The plane had descended much too soon for Washington to be its intended destination, these assessments indicate, suggesting that the true target may have been one of several nuclear plants in its flight path, with the single still-operating unit at Three Mile Island seeming the most likely. This assessment cannot be confirmed, of course. But if it is correct, we owe even more to those brave passengers who succeeded, at the cost of their own lives, in bringing the plane down before it reached its intended target.

Misleading statements

Immediately after the September 11 attacks, the U.S. Nuclear Regulatory Commission (NRC) and the nuclear industry issued statements asserting that U.S. reactor containments were designed to withstand the crash of a fully loaded jumbo jet. Within days, both had to recant and admit that the opposite was the case. Just hours after the terrorist attacks, NRC spokesperson Breck Henderson said U.S. nuclear plants were safe because “containment structures are designed to withstand the impact of a 747.”

Ten days later he admitted that “the initial cut we had on that was misleading.” In a formal statement, the agency conceded that it “did not specifically contemplate attacks by aircraft such as Boeing 757s and 767s, and nuclear power plants were not designed to withstand such crashes.” A similar pattern of assurance followed by retraction characterized the behavior of public relations personnel for a number of specific nuclear sites.

Early on, however, David Kyd, spokesperson for the International Atomic Energy Agency (IAEA), was quoted as saying that most nuclear plants, built during the 1960s and 1970s, were designed to withstand only accidental, glancing impacts from the smaller aircraft used at the time. “If you postulate the risk of a jumbo jet full of fuel, it is clear that their design was not conceived to withstand such an impact,’’ he said. In reporting Kyd’s comments, the Associated Press quoted an unnamed U.S. government official to the effect that a direct hit at high speed by a modern jumbo jet “could create a Chernobyl situation.”

The press has focused on the vulnerability of reactor containment buildings to airborne attack. But there are also “soft targets” outside containment, and their protection is critical to preventing radioactive release. Excessive emphasis on the risk of air attack obscures the far larger and more frightening possibility of ground assault or the threat from insiders. Security at the nation’s nuclear plants has been grossly inadequate for decades, and the nuclear industry and its captive regulatory agency, the NRC, have refused to do anything about it—both before and after September 11.

1,000 times more

A typical nuclear power plant contains within its core about 1,000 times the long-lived radioactivity released by the Hiroshima bomb. The spent fuel pools at nuclear power plants typically contain some multiple of that—several Chernobyls’ worth (see “What About the Spent Fuel?” page 45).

Any analogy with the dropping of a bomb is imperfect, of course, because much of the destruction caused by an atomic bomb comes from blast effects, and the damage caused by a terrorist attack on a nuclear plant would stem almost exclusively from the release of radioactivity. However, the potential casualties from an atomic attack and those resulting from using conventional explosives to produce a radiological release from a nuclear facility would be surprisingly similar. For example, the NRC estimated years ago that a meltdown at one of the San Onofre reactors in Southern California could produce 130,000 “prompt” fatalities, 300,000 latent cancers, and 600,000 genetic defects. Analyses for other reactors performed by Sandia National Laboratories for the NRC estimated damages up to $314 billion in 1980 dollars (the equivalent of about $700 billion today).

Because there is an immense amount of radioactivity at a reactor, and because the fuel must be constantly cooled to prevent it from melting and releasing that radioactivity, it is not difficult to understand why nuclear facilities might be a tempting target. As Bennett Ramberg pointed out in 1984 in his seminal book on the subject, Nuclear Power Plants as Weapons for the Enemy: An Unrecognized Military Peril, any country that possesses nuclear energy facilities gives its adversaries a quasi-nuclear capability to use against it. Conventional explosives—a truck bomb, for example—could cause a massive radiological release, with terrorists turning their adversaries’ own technology against them. And just as simple box-cutters were used to convert U.S. jumbo jets into guided missiles, conventional means could turn U.S. nuclear plants into radiological weapons. The need to protect nuclear facilities against terrorist attack should be obvious.

    Minimal protection

Yet for decades, NRC regulations have required only minimal security. Fifteen years ago in the March 1986 Bulletin (“Protecting Reactors from Terrorists”), two colleagues and I warned even then that terrorist trends were rendering the NRC security rules inadequate. But with only a single, partial exception, the agency’s primary security regulations are unchanged from a quarter century ago. And despite September 11—when the NRC’s assumptions crumbled at the moment the Twin Towers fell—both the industry and the agency that regulates it continue to resist making any significant improvement to dismally inadequate and outmoded security regulations.

We reported in 1986—and it is still the case today—that NRC regulations require nuclear reactor operators to protect against no more than a single insider and/or three external attackers, acting as a single team, wielding no more than hand-held automatic weapons.

Security personnel at power reactors are not required to be prepared for:

• more than three intruders;

• more than one team of attackers using coordinated tactics;

• more than one insider;

• weapons greater than hand-held automatic weapons;

• attack by boat or plane; or

• any attack by “enemies of the United States,” whether governments or individuals.

For years, reactor sites were not even required to provide protection against truck bombs. But after a decade of efforts by the Committee to Bridge the Gap and the Nuclear Control Institute to get the agency to strengthen security and repeated refusals by the NRC to require greater protection, the 1993 World Trade Center bombing and an intrusion event at Three Mile Island finally propelled the agency to amend the rules. But the truck bomb rule is still a concern because of the limited size of the explosion that operators must protect against. It apparently requires protection against truck bombs of roughly the size used at the World Trade Center in 1993, but not the larger quantities of explosives that have been used in similar attacks since then. The NRC is behind the curve, “fighting the last war” rather than protecting against threats that can materialize without warning.

To deal with the limited threat that the NRC does recognize—called the “design basis threat” (DBT)—the agency requires a nuclear power plant to be guarded by a total of five individuals. It may seem incomprehensible in today’s world that targets capable of producing tens or hundreds of thousands of casualties and hundreds of billions of dollars of damage are protected by a mere five guards, but that is the minimum the NRC mandates.

The events of September 11 demonstrated the inadequacy of the agency’s quarter-century-old security rules. There were 19 terrorists on the planes, and possibly additional participants in the conspiracy—far in excess of the three external attackers the NRC envisages. They acted as four coordinated teams, but the NRC rule requires the nuclear industry to guard against only a single team. They used jumbo jets filled with jet fuel as their weapons, far more lethal than the hand-carried automatic weapons and explosives contemplated in the regulation. They were very sophisticated, training for months to fly big jets, and willing to die—a level of motivation and capability far beyond that upon which the NRC rules are predicated.

None of the details of the agency’s DBT are secret. With a single exception discussed below, they can all be found in the Code of Federal Regulations, available in most libraries and on the Internet. Any potential adversary can immediately learn that the required security arrangements that protect these high-value targets are inadequate.

Three external attackers . . .

The only aspect of the DBT that is not explicitly stated in the Code is the famous number “three”—the maximum number of external attackers against which reactor owners must provide protection. The Code indicates that reactors must be protected against an attack by “several” intruders, and that “several” is less than the number required to operate as more than one team. This is enough to give a pretty clear indication of exactly how small the DBT is, but other publicly available documents make it clear that “several” means three.

The number was publicly revealed as a consequence of the licensing hearings for the Diablo Canyon nuclear plant in California in the early 1980s. The Governor of California was a party in the hearings, in which the adequacy of security at the plant was a key issue. The state’s security experts testified that a dozen attackers was a credible number to safeguard against. But the utility, Pacific Gas & Electric (PG&E), and the NRC staff argued that irrespective of any threat that might exist, NRC requirements were far more modest. The precise number in the DBT became a key issue in the hearings.

The NRC’s Atomic Safety and Licensing Appeal Board decided in favor of PG&E and the NRC staff, expressly ruling on how many attackers a reactor operator is required to protect against. The ruling was not immediately published on the theory that it contained sensitive information. The specific number for the DBT, according to the Diablo decision, was withdrawn at the last minute from the published regulations and replaced with “several,” not for any security reason, but because the commission thought it would have trouble explaining to the public why it was requiring a lesser level of protection against sabotage for reactors than against theft at non-reactor sites. This remains the case today—NRC nervousness about public discussion of the DBT of three external attackers is not motivated by a security concern, but by fear of embarrassment were it widely known that it only required reactors be capable of protecting against no more than a trivial terrorist challenge.

The Governor of California, however, asked that an expurgated version of the decision be published, and the agency agreed. When the “sanitized” Appeal Board decision was released, the actual number had been deleted. But ironically, the remaining text explained what “several” meant, and other underlying documents cited in the text—which had been publicly released—gave away the actual number.

The Appeal Board ruling cited a number of NRC documents it relied on in concluding that the DBT should be limited to three attackers. And although the ruling was redacted, all of the underlying documents were available in the NRC’s public reading room. Those documents, the “SECY Memoranda,” are the agency’s actual decision documents on adopting the rule. Over and over again the SECY Memoranda state that the DBT in the rule is “an external threat of one to three persons armed with pistols, shotguns, or rifles (including automatic weapons), and who may be assisted by an insider (employee or unescorted person).” This is the so-called “three-and-one” threat described in publicly available NRC documents.

The Appeal Board decision discloses some of the rationale for settling on three external attackers. First, the board states, power plants by rule are not required to protect against more than one team of attackers—only fuel-cycle facilities with weapons-grade material must do that. Because the minimum number of attackers who could operate as more than one team is obviously four, three is the maximum number of attackers who cannot act as more than one team.

    . . . and five guards

Second, and perhaps most astonishingly, the Appeal Board discloses how the regulation’s minimum force of five guards was derived:

“A response force ratio (i.e., ratio of guards to attackers) must be equal to 1 [1 to 1] to protect power reactors. The report [the NRC staff report that formed the basis for the numerical determination for the design basis threat] then states: ‘Given the above response force ratio modified by a measure of conservatism, the minimum number of guards available for response to an assault may be determined. Therefore, for the presently specified threat, the minimum number of guards available for response at a nuclear power plant is judged to be 5’” (emphasis added).

The Appeal Board decision went on to indicate that the “presently specified threat” referred to was the external threat (of three) along with a single insider capable of participating in a violent attack. This three-and-one threat created a maximum total of four attackers. A 1:1 ratio of guards to attackers would require only four guards. But modifying the ratio “by a measure of conservatism” (giving the guards a one-person advantage) resulted in the regulations requiring a minimum of five guards.

(The actual regulation mentions a “nominal” number of 10 guards, with a minimum of five. But the Diablo decision and underlying documents indicate that this “nominal” number was employed to “camouflag[e] the exact threat.”)

Thus, the NRC security regulations, unchanged except to require protection against small-sized truck bombs, require operators to protect against an attack by three outsiders, perhaps aided by one insider, with no team-maneuvering tactics, no attack by boat or air, and minimal hand-held weapons.

This rule made little sense when it was first adopted, and it makes even less today. The September 11 attacks—with at least 19 attackers, four times as many teams, and a level of sophistication far beyond that contemplated by the agency—blew away the NRC’s security regulations. Yet those regulations remain unchanged.

    Seventeen years of trying

For 17 years, my group, the Committee to Bridge the Gap, joined by the Nuclear Control Institute, has worked quietly behind the scenes in a largely futile effort to convince the NRC to upgrade its security requirements. With one partial exception, the truck bomb rule, we have failed.

In 1984, in the wake of truck bombings in the Middle East, the NRC staff decided to consider requiring protection against truck bombs at U.S. power reactors. It commissioned Sandia National Laboratories to study the vulnerability of plants to truck bomb attacks. The results were frightening—small truck bombs could cause “unacceptable damage to vital reactor systems,” and larger truck bombs could have the same effect, even if detonated off site, because the exclusion zone surrounding many facilities is small. Inexplicably, after the study was conducted, the agency dropped the idea of a truck bomb rule.

In 1985, the Committee to Bridge the Gap testified before the Safeguards and Security Subcommittee of the NRC Advisory Committee on Reactor Safeguards, pointing to data showing increasing terrorist capabilities and actions, urging the agency to upgrade the regulations to deal with larger attacking forces and with truck bombs. The response was unenthusiastic, with many subcommittee members indicating that there were so many ways to destroy a reactor that, if you protected against truck bombs, you’d have to protect against all those other vulnerabilities as well.

Over the next few years, both the Committee to Bridge the Gap and the Nuclear Control Institute continued to push the NRC to upgrade security regulations, to no avail. In 1991, at the time of the war with Iraq and the prospect of terrorist attacks against U.S. targets, we formally petitioned the NRC to upgrade its regulations. In addition to urging protection against truck bombs, the petition called for a new DBT with 20 external attackers (ironic in light of the 19 terrorists on the planes on September 11) capable of operating as two or more teams, with weapons and explosives more significant than hand-held rifles. The NRC denied the petition, ruling that “there has been no change in the domestic threat since the design basis threat was adopted that would justify a change.”

Finally, after the truck bomb attack on the World Trade Center in 1993 and an event at Three Mile Island in which an intruder drove a station wagon through the perimeter and into the turbine building, where he stayed for hours while security tried to figure out if he had a bomb, the NRC adopted a new rule requiring some measure of protection against truck bombs. However, the rule may not be sufficient to protect against truck bombs of the size that have been used since 1993.

The rest of the DBT remains unaltered, despite the NRC’s promises in 1994 that in a second phase it would consider upgrading the rest of the security regulations.

In fact, a number of actions have weakened security. For example, in 1996 the NRC issued Generic Letter 96-02, “Reconsideration of Nuclear Power Plant Security Requirements Associated with an Internal Threat.” It permitted “reductions in unnecessary or marginally effective security measures,” granting licensees the option, for instance, to keep “doors to vital areas . . . unlocked.”

    One counterterrorism program, killed

In late 1998, I received a plain manila envelope in the mail. Inside were documents indicating that the NRC had recently terminated its only counterterrorism program, called the Operational Safeguards Response Evaluation program, (OSRE). The program evaluated nuclear plant security by undertaking mock terrorist attacks—“black hat” force-on-force exercises. The documents contained astonishing information: Given six months advance warning, including the date on which the security test would occur, plants prepared by increasing their guard force by as much as 80 percent. Even so, security failed the tests. In nearly half of the tests conducted at the the country’s reactors, mock terrorists penetrated security and reached at least one “target set” that, had the intruders been actual terrorists, could have resulted in a meltdown and massive radioactivity release.

This failure rate is extraordinary. No terrorist group is going to give notice six months in advance of when and where it intends to attack. And these tests were against the existing DBT—against only three intruders.

Other publicly available NRC documents from the early 1990s indicate that in an OSRE test at the Peach Bottom reactor, it took only 17 seconds for the mock terrorists to penetrate the perimeter fence and breach the access control barrier. It took intruders 18 seconds at San Onofre, 30 seconds at Duane Arnold, and 45 seconds at Maine Yankee.

And what was the response to this dismal failure rate? The NRC killed the program—there could be no more failures if there were no more tests.

My organization passed the OSRE documents along to the Los Angeles Times, which ran a major story about the program’s termination. The agency was sufficiently embarrassed that a couple of days later Shirley Jackson, then NRC chair, reinstated the program. Since then, however, the industry and the agency have worked together to gut the tests. Earlier this year, the NRC approved the industry’s proposed self-evaluation program that would replace NRC-run force-on-force tests. Companies failing the independent tests are now able to test themselves! The problems inherent in self-regulation should be obvious.

  After September 11

Our two organizations have persisted in so-far-fruitless attempts to get the DBT upgraded. Last year, we met with NRC Chairman Richard Meserve, trying once again to get the NRC to fix gaping security problems. Nothing came of the meeting. As we were leaving, Meserve said we should feel free to see him again, adding something to the effect that he meets with industry “all the time,” and there is no reason he can’t meet with public groups from time to time as well. (And indeed, as we left we saw a number of industry lobbyists sitting outside his office waiting to go in.)

After September 11, we wrote to Chairman Meserve, urging him to recommend that the National Guard be called out to protect all the nation’s reactors, that air defenses be deployed to protect them, and that employees and contractor personnel be thoroughly re-vetted.

We also asked the NRC to upgrade its security regulations immediately to protect against attacks involving greater numbers, operating as multiple teams, with more than one insider; require a strong two-person rule and other enhanced measures to protect against insiders; require protection against a truck bomb as big as a large truck can carry; require protections against boat and airplane attacks; require full security protection of spent fuel storage pools and dry cask storage, including after reactor closure; and that the Operational Safeguards Response Evaluation program be reinstated and expanded.

The NRC response was business as usual. The agency is continually reviewing the DBT, we were told, just as we have been told for the last 17 years.

But no improvements were promised and none has been made. Both the Committee to Bridge the Gap and the Nuclear Control Institute have decided that after years of quiet work it is time to go public about these problems. It is clear that the United States has sophisticated adversaries out there and everything we know is available to them as well. The only people not taking the danger seriously are the ones who should be required to do something about it—the nuclear industry and the agency that is supposed to regulate it.

All the NRC has done in the wake of the attacks on the World Trade Center and the Pentagon is to recommend—not even require—that licensees go to a higher state of alert within their existing security system and within the existing DBT. A no-fly-zone excluded small planes from flying near power reactors, but after a week that restriction was lifted. The federal government has failed to call out the National Guard—although in the absence of federal action, some governors have taken that step on their own. The NRC and the industry strongly oppose legislation introduced by Sens. Harry Reid, Hillary Clinton, Jim Jeffords, Joe Lieberman, and Cong. Ed Markey that would have required the agency to upgrade security regulations.

In 1981, the NRC and industry argued against the Governor of California’s contention in the Diablo case that there should be protection against up to a dozen terrorists, saying such an attack wasn’t credible. In 1991, the NRC and industry argued against our rulemaking petition that the DBT be increased from three to 20 external attackers operating as several teams, against asserting that there was no evidence there could ever be an attack of more than three as a single team. Protections against attacks by boats, large truck bombs, or from the air remain beyond the design threat. On September 11, 19 attackers in four teams using planes caused the worst terrorist event in U.S. history. Yet the NRC and industry refuse to upgrade the DBT regulations to a level consistent with the now-evident threat.

The industry’s response is shocking. Rather than conceding the vulnerability of its facilities and the need to upgrade security, at a press conference on September 25 a spokesman for the Nuclear Energy Institute took the extraordinary stand that greater security isn’t required because Chernobyl wasn’t that bad.

Why does the industry continue to ignore the need to protect its facilities? First, more security means more expense, and its every instinct is to avoid current expenses. Second, if it admits its reactors are vulnerable, the industry’s dream of a nuclear renaissance is diminished.

Having received a big boost from the Cheney energy plan, the industry had been hoping to build new reactors, supposedly of the new pebble-bed design. In order to save money, these “passively safe” reactors would be built without a containment structure. In addition, they are made of graphite, which burns readily, as evidenced by Chernobyl and the earlier Windscale accident in Britain. As poorly resistant to terrorism as today’s reactors are, pebble-bed reactors would be far worse. Furthermore, the industry-Cheney proposals involve a revival of the idea of reprocessing spent fuel to separate plutonium, which would then be used in civil reactors, creating a massive additional risk that terrorists might acquire nuclear weapons materials from poorly guarded civilian power plants. The nuclear industry hopes that its post–September 11 problems will go away, without having to upgrade security.

And why has the NRC not imposed upgraded security requirements? Put bluntly, the NRC is arguably the most captured regulatory agency in the federal government, a creature of the industry it is intended to regulate. Efforts to separate its promotional and regulatory functions, which led to the breakup of the Atomic Energy Commission in the mid-1970s, have failed utterly. The NRC’s principal interest is in assisting the industry, keeping regulatory burdens and expenses to a bare minimum, and helping to jumpstart the nuclear enterprise.

But the risk of terrorist attack at one or more nuclear plants is simply too great to allow this failed agency and the industry it allegedly regulates to continue to ignore the need to provide reasonable protection. The industry’s short-term economic or political concerns pale in comparison to the damage that would occur if attackers turn the nation’s reactors into radiological weapons.

Daniel Hirsch is president of the Committee to Bridge the Gap, a Los Angeles- based nuclear policy organization.