POGO's Message to NRC: Security Culture Change Starts at the Top

On February 3, 2009 POGO's Peter Stockton presented comments at the Nuclear Regulatory Commission's (NRC) "Public Workshop on Development of a Policy Statement on Safety Culture and Security Culture."

The following is a brief summary of the presentation:

• The NRC staff has done a great job recognizing that there is a security problem at the power plants. Unfortunately, they were voted down on a recent Design Basis Threat (DBT) increase and a security information transparency issue.

• POGO is agnostic on the need for a new policy statement. The current one states that reactor operators should not be drunk or asleep in the control room. Although this seems pretty self-evident, the process of identifying these cultural problems can still be productive.

• Problems with NRC's security culture starts at the top with the NRC Commissioners themselves.A year ago, POGO interviewed each Commissioner. We learned that some simply don't believe there is a serious terrorist threat to the nuclear power plants. This attitude was reflected in a vote last week to turn down a staff recommendation to make the DBT more robust by updating the number of adversaries and lethal weapons available to terrorists, and including 50 cal. Bangalore torpedoes and RPGs.In addition, one Commissioner recently made misleading and disparaging remarks to the Senate about a Peach Bottom security whistleblower, resulting in an IG investigation.

• Since 2002, POGO has interviewed or met with several hundred security officers. Based on these interviews, we believe security culture is a real problem. Security officers recognize that the DBT is unrealistic and that they would be cannon fodder in a real attack. They refer to the DBT as the "Dollar Based Threat." But when questioned about the inadequate DBT, NRC's response is "that is all you can expect of private guard force." This kind of dangerous attitude can have a serious impact on the security culture at the plants.

• There is too much advance notice of force-on-force security tests. It seems like the NRC is more concerned with making the plants look good than determining how well the plants are actually protected. The plants almost always pass the tests because there is no surprise, no speed, and no violence of action, all of which are major advantages that terrorists usually have on their side.

• Security officers' concerns are not taken seriously by the security contractors or the licensees, who usually respond by saying "we don't have the money" or "we're in compliance with NRC regulations." Security officers inevitably stop bringing up issues because nothing ever gets addressed. In a number of cases, they are afraid to speak out due to a fear of retaliation, such as the threat of being fired. The current whistleblower protections at the NRC are simply not enough.

• The recent incidents at Peach Bottom uncovered serious problems with the NRC's security culture. When confronted with the issue of sleeping guards, security officers went to the press because they didn't trust the NRC. In March 2007, the NRC Regional Office found "no safety problems" at Peach Bottom. It wasn't until September 2007 that the Office finally acknowledged "possible safety problems," and only then because they learned about the sleeping guard video. Even after the IG report came out on Peach Bottom, no heads rolled as a result.

Weak enforcement does not reinforce a culture of security. The $65,000 fine to Exelon for the sleeping guard incident pales in comparison to the cost of NRC investigating the matter, which came to around $500,000.