Dear Mr. Chairman:

 We are writing regarding a report entitled “Nuclear Power Plants: Efforts Made to Upgrade Security, but the Nuclear Regulatory Commission’s Design Basis Threat Process Should Be Improved” released on April 3, 2006 by the Government Accountability Office (GAO). The report concluded that “GAO found that the process used to obtain stakeholder feedback created the appearance that changes were made based on what the industry considered reasonable and feasible to defend against rather than on an assessment of the terrorist threat itself.”

Instead of promulgating security regulations adequate to protect against a terrorist attack, the Commission seems to have issued security orders that are sufficient only to protect the nuclear industry’s bottom line.  The Energy Policy Act of 2005 contains legislative language directing the Commission to promulgate regulations to upgrade security at nuclear reactors within 18 months of that bill’s enactment. These permanent regulations required by law are intended to result in security levels necessary to protect against a terrorist attack, not in security levels that won’t cost the industry too much money. Rep. Markey is the author of many of these provisions that were enacted into law.  We request your prompt responses to the following questions:

1) The GAO report stated that “in its written comments on the January 2003 draft DBT [Design Basis Threat, which forms the basis of the security measures that nuclear reactor licensees are required to follow], NEI [the Nuclear Energy Institute, the lobbying organization for the nuclear industry] objected to the size of the vehicle bomb, the inclusion of certain weapons, and the inclusion of an active violent insider. The NRC staff’s draft DBT submitted to the commissioners reflected some (but not all) of NEI’s objections.”  According to GAO, the Commissioners then made further modifications to the staff recommendations.  Was anything that NEI objected to in its written comments retained in the 2003 DBT?  If so, what was it?

2) Section 651 of the Energy Bill states that the NRC must undertake a rulemaking within 90 days of the date of enactment to upgrade the DBT.  The provisions list numerous considerations the Commission must take into account.
a) The rulemaking described in the law must be completed within 18 months of enactment.  Will you meet this deadline? If not, why not, and when do you expect the rulemaking to be complete?
b) After the rulemaking is complete, how long will licensees have in which to comply with the new regulations?
c) The legislative language states that the Commission must consider “the potential use of explosive devices of considerable size and other modern weaponry”. However, the GAO report states that “following meetings with industry, the staff decided not to recommend including certain weapons in the list of adversary characteristics that nuclear power plants should be prepared to defend against.”  Moreover, the Commission subsequently chose to remove two of the weapons the staff did recommend. These weapons have been reported to be rocket-propelled grenades and 50-caliber rifles with armor-piercing rounds- both widely accepted as being modern weapons that would be readily available to a terrorist group.  Moreover, according to the GAO report, in an April 2003 NRC staff report to the Commissioners, “the NRC staff reported that while one such weapon had not been used in the United States, it had been found in weapons caches in the United States. Similarly, the staff noted the use of the other weapon in captured terrorist training videos and its ready availability.”  Do you plan to include these weapons in your statutorily required DBT regulations, and if not, why not?
d) If these weapons are among those a terrorist would be expected to use, but the licensees are not expected to protect nuclear reactors against their use, then who is responsible for doing so?
e) The GAO also stated that NRC staff “considered a larger vehicle bomb size but decided against the larger size after obtaining comments from stakeholders, including the nuclear industry.”  Was the truck bomb size considered but rejected by Commission staff larger or smaller than the truck bombs used in the 1993 World Trade Center bombing and the 1995 destruction of the Murrah Building in Oklahoma City?  If smaller, what was the NRC staff’s justification for deciding against a requirement to protect against a truck bomb smaller than that already used in attacks on U.S. soil? 
f) The GAO report states that the Commission overruled staff recommendations regarding the amount of weight a terrorist could carry, making that limit lighter (which presumably implies that the terrorist would be able to carry less ammunition or weaponry while carrying out the attack).  According to the GAO, the staff based its weight recommendation on the expertise of NRC personnel with security backgrounds. On what basis did the Commission reduce the weight recommendation provided by NRC staff? Please provide a complete explanation, with supporting documentation used in making the decision.
g) The GAO report states that the Commission believes that “multiple cells along the lines of the September 11, 2001, attacks would not necessarily target a single nuclear power plant.”  Section 651 of the Energy bill calls for a DBT that considers “the potential for attack on facilities by multiple coordinated teams of a large number of individuals.” Does the Commission plan on including a requirement to protect against multiple teams of attackers attacking a nuclear reactor in its DBT rulemaking? If not, why not?

3) The GAO report found that the Commission made some of its determinations not to follow staff’s recommendations on which security measures to require on the grounds that it would not be reasonable to expect a private sector entity to assume the costs of those measures.  The GAO report went on to state that “the commissioners did not identify explicit criteria for what is and is not reasonable for a private security force to defend against, such as the cost of defending against particular adversary characteristics. NRC officials said detailed criteria on what is reasonable for a private security force would reduce the commissioners’ discretion in approving changes to the DBT.” 
a) Please list each staff recommendation for the 2003 DBT that Commissioners rejected or altered. For each such change, please provide a full and detailed explanation, including supporting documentation, for the Commission’s decision. For example, if the Commission made a decision not to include a particular weapon in the DBT because it concluded it would be unfair to expect the industry to assume the costs of including it, please provide evidence of these costs considered by the Commission.
b) Who is responsible for ensuring the adoption of security measures that are supported by intelligence and other information but were rejected either by NRC staff or the Commission on the grounds of lack of affordability for the nuclear industry? Is it the Commission’s position that if the industry says it can’t afford it, then the industry doesn’t have to implement it, irrespective of the need for such measures?
c) Why does the Commission believe it should have complete discretion to add or subtract elements from the DBT? Shouldn’t changes be made exclusively as a result of intelligence information made available to the Commission using a process that is both predictable and transparent? If not, why not?
d) If intelligence and other security information (i.e. input from other Federal agencies, information regarding the availability of certain weapons, etc) is ignored by the Commission when the DBT is altered on the grounds that the industry cannot be expected to pay for the costs, why didn’t the Commission request the funds from Congress on the grounds that someone needed to ensure that the needed levels of security were met? Who does the Commission believe should be responsible for assuming these costs – other than the citizens living near the communities who are left unprotected as a result of the Commission’s decision to cater to the demands of the nuclear industry?

4) The GAO report stated that while the NRC staff recommended a DBT that included assistance from a passive and/or active insider, the Commission included a modification that said that “the likelihood of an active insider can be reduced by a human reliability program, which consists of policies and procedures such as substance abuse testing, designed to help ensure the reliability of personnel.” 
a) On what basis did the Commission assume that human reliability testing such as substance abuse testing can decrease the likelihood of assistance in a terrorist attack by an active insider? Please provide all supporting documentation for this assumption.
b) In March, 2005, Rep. Markey wrote you a letter regarding reports that illegal aliens using false social security numbers had obtained access to some areas of a Florida nuclear reactor.  In report number EN 00-022, the NRC banned Ms Gail VanCleave from working in the nuclear industry for 5 years because she evidently used her dead mother’s social security number to gain access to the D.C. Cook reactor. Clearly, it is possible that even with screening procedures in place, unauthorized individuals have obtained access to nuclear reactors in the past.  In light of these events, why would the Commission assume that it could guarantee that the implementation of any procedures, including but not limited to social security number checks or substance abuse testing, would ensure that no active insider assistance would be made available to terrorists? Isn’t it possible that a terrorist could apply for and receive a job at a nuclear reactor using a legitimate social security number and after passing a substance abuse test? Wouldn’t it be safer to require the nuclear industry to adopt real security measures such as employing additional security guards and installing better access controls to protect against the active insider threat?
c) Section 651 of the Energy Bill states that the Commission must consider “the potential for assistance in an attack from several persons employed at the facility” when it revises its DBT.  Do you plan to require the nuclear industry to protect against active assistance from more than one insider? If not, why not?
d) The GAO report states that the force-on-force exercises conducted by the NRC have included the use of passive insider assistance. Have any exercises included the use of active insider assistance, and if not, why not, since active insider assistance is reportedly included in the DBT? If you have never included active insider assistance in force-on-force exercises, how do you know whether the ‘human reliability program’ or other measures in place to protect against it are adequate?

5) The GAO report stated that “the commissioners considered whether any of the recommended changes to the DBT constituted characteristics representative of an enemy of the United States, which sites are not required to protect against under NRC regulations.”
a) Please provide the list of characteristics used by the Commissioners to define “enemy of the United States.”
b) Where did the Commissioners obtain this list?
c) How many of these characteristics does the Commission believe an adversary (or group of adversaries) must possess before he/she can be considered an “enemy of the United States”?

6) The GAO report states that “during a force-on-force inspection at one site, we observed that although the security measures appeared impressive, the site’s ability to defend against the DBT was at best questionable. The site’s security measures were similar to those we observed at other sites, such as an intrusion detection system equipped with cameras for assessing alarms, bullet-resistant structures both in the protected and vital areas, and a vehicle barrier system consisting of large concrete blocks and large boulders. However, some or all of the attackers were able to enter the protected area in each of the three exercise scenarios. Furthermore, attackers made it to the targets in two of the scenarios, although the outcomes of the two scenarios were called into question by uncertainties regarding whether the attackers had actually been neutralized before reaching the targets.”
a) Does the Commission agree that, had the attack described above been real, the terrorists could have accessed areas of the reactor necessary to cause a core meltdown? If not, why not?
b) For each force-on-force inspection conducted since September 11, 2001 please provide i) the name of the reactor site and date of the inspection, ii) the result of the inspection, including whether for each exercise scenario, the mock attackers were able to access sensitive areas of the reactor, iii) what corrective actions were ordered as a result of the inspection and iv) for cases in which attackers were able to access sensitive areas of the reactor, whether the NRC had conducted subsequent force-on-force exercises to verify the adequacy of the corrective measures taken and if so what the results were.

7) On October 27, 2005, the Commission voted on the proposed rulemaking to increase the DBT requirements   The Commission stated that it had “carefully considered including an airborne attack in the proposed DBT rule, but has not included a specific attribute of air-based threats.” However, the NRC has “required nuclear power plant licensees to implement enhancements to mitigate potential consequences in the unlikely event of a successful attack, including aircraft, on a nuclear power plant.”
a) Mitigating the consequences of a successful attack is important, but so is preventing those consequences from occurring in the first place.  Will the Commission be considering requiring the current reactor operators to move spent fuel to dry cask storage as soon as it can be safely moved, in order to reduce the likelihood that an attack on a spent fuel pool would result in a large fire? If not, why not?
b) What about reactors that might be built in the future? Does the Commission plan to issue regulations that require the containment structure, spent fuel storage area and other parts of the reactor facilities to be designed and constructed in a manner that would better secure them against airborne and other terrorist attacks?  If not, why not – doesn’t it make sense to incorporate better security into the requirements for these reactors BEFORE they are designed and constructed?

Thank you for your prompt consideration of this important matter. Please provide your response in a releasable form, with a safeguards/classified annex if necessary, no later than Friday June 16, 2006. If you have any questions or concerns, please have your staff contact Dr. Michal Freedhoff (Rep. Markey, 202-225-2836) or Michele Jalbert or John Juech (Rep. Delahunt, 202-225-3111).

    Sincerely,

Edward J. Markey      William D. Delahunt