GAO investigation: Investigators set up shell companies that used fraudulent licenses to purchase a category-3 quantity of radioactive materials from two vendors in the United States. The investigators provided the vendors with forged licenses, received invoices, and paid for the radioactive materials. To ensure that the materials were safely and securely returned to the vendors, the investigators did not accept shipment at the point of delivery.
The investigation “demonstrated that a bad actor might be able to obtain a category-2 quantity by purchasing and aggregating more than one category-3 quantity from multiple vendors,” enabling easy production of a dirty bomb. The report noted that “GAO's shell companies were successful in acquiring the material because they are not subjected to more stringent controls required for purchases of larger quantities of material.”
Recommendations to NRC: GAO has called for the NRC to take the following actions: “(1) immediately require vendors to verify category 3 licenses with the appropriate regulatory authority and (2) add security features to its licensing process that improve the integrity of the process and make it less vulnerable to altering or forging licenses.”
After being provided with these recommendations, the NRC reportedly stated that it “plans to proceed with existing initiatives to implement new verification regulations by late 2023 but does not plan to take immediate corrective actions to address the issues that GAO found.” The report concluded that “vulnerabilities will remain until NRC implements the [new] rule.”
NRC response: NBC News reported that the NRC is informing manufacturers of radioactive substances about GAO’s findings and is “expediting a rule change to better verify purchasing licenses.” However, the NRC has also said that GAO’s findings “do not warrant an emergency change in the rules”: “Imposing immediate security requirements would risk unintended impacts to important and safe medical, academic, and industrial uses of these materials.”
