POGO's letter to Nuclear Regulatory Commission Chairman Diaz on the proposed Design Basis Threat (DBT)

Annette Vietti-Cook, Secretary

U.S. Nuclear Regulatory Commission

11555 Rockville Pike

Rockville, MD 20852

Attn: Rulemaking and Adjudications Staff

Chairman Nils J. Diaz

U.S. Nuclear Regulatory Commission

11555 Rockville Pike

Rockville, MD 20852

Re: RIN 3150- AH60, Proposed Rule 70 FR 76,380 “Design Basis Threat”

Via email to [email protected] and

Via facsimile: (301) 415-1757

Dear Chairman Diaz,

I understand you intend to leave the Chairmanship of the Nuclear Regulatory Commission (NRC) this year. I also understand that you would like to leave behind a lasting legacy. I am taking advantage of the current rulemaking process to write to you about what is, without exception, the single most important matter entrusted to you by the American public – the federal government’s security standards for the nation’s nuclear power plants.

As you know, the Design Basis Threat (DBT) is the bedrock of the NRC’s security posture. It includes the number of adversaries, the weapons they are likely to use, and the size of the truck bomb against which a nuclear power plant must defend. Prior to 9/11, the number of adversaries against whom nuclear power plants had to guard was a pathetic three. Two years after the 9/11 attacks involving 19 terrorists, the Commission only raised the security requirements to protecting against five terrorists – a paltry response to what we have learned about the capabilities and tactics of terrorists from the 9/11 attack and other terrorist attacks around the world. (Interestingly, air attacks are still not seriously addressed in the DBT.)

During my 2004 address at the NRC’s annual Regulatory Information Conference, I argued that a serious terrorist attack on a nuclear plant would involve no less than a “squad size” of adversaries (12 personnel for US Army Special Forces; 14 personnel for Navy SEALs). Our sources on this recommendation are Army Special Operations, Navy SEALs, Pentagon, and Defense Threat Reduction Agency (DTRA) personnel. I also argued that terrorists would bring far more lethal weapons than are included in the NRC DBT. I pointed to a Department of Energy (DOE) film – “Systems Under Fire” – which demonstrates the types and lethality of the weapons available to and regularly used by terrorists. Rather than focusing on the substance of the DOE’s findings and upgrading the NRC’s security requirements accordingly, NRC Commissioners met on more than one occasion with the Deputy Secretary of DOE arguing that the film should be classified.

The NRC’s DBT baseline is counter-intuitive. Instead of sizing the DBT on the actual threat, the NRC bases security standards on what the NRC (or perhaps the nuclear industry) believes a private guard force can be expected to handle. You wrote in the June 2005 rule-making on the DBT that, “The DBT is based on actual demonstrated adversary characteristics and a determination as to those characteristics against which a private guard force could reasonably be expected to provide protection.” [emphasis added] Yet surely you are aware that DOE nuclear weapons facilities are also protected by private guard forces, and are expected to handle a DBT more than three times the level of the NRC’s. The NRC’s security standards should be based on security needs, not the financial impact on private industry. The NRC must better articulate what, exactly, is too much for a private security force to be expected to handle. The lack of specificity on this question is allowing basic threats to be utterly ignored.

The corollary problem is the hollow assurance made by the NRC that outside credible SWAT capability will arrive and take over from private security forces at the point where they are no longer capable of or responsible for to protecting the plant or surrounding community. It is unrealistic to believe that the nuclear plants can depend on outside help to defeat a terrorist attack. The consensus among those security experts consulted by POGO is that a suicidal attack on a nuclear plant aimed at the reactor or spent fuel pools would be finished, one way or the other, in 3-10 minutes. I am sure you’re aware that it will take between 1 ½ to 2 hours for outside law enforcement help to arrive, be briefed on the status of the attack, communicate with what is left of the guard force, and engage in battle – long after the battle would have been over.

POGO has an unclassified list of the weapons that Department of Homeland Security experts believe would be used by adversaries in the event of an attack on a nuclear facility. However, we understand that many of these weapons are not in the NRC DBT. We have reason to believe that the NRC’s security staff recommended to the Commissioners that nuclear power plants be prepared to protect against Rocket-Propelled Grenade (RPG) attacks – but the Commission recently voted against this sensible security requirement in a 3-1 vote. During a Special Forces mission in West Africa last year, Pentagon officials found that an RPG-4 could be purchased for less than $10 U.S. on the weapons market, and were available in large quantities in a matter of hours. This is equally true in South Asia. Pentagon officials have told POGO that getting shipments of RPG’s into the U.S. would be surprisingly easy. If it is true that RPG’s have not been included in the NRC’s DBT, there is simply no excuse for it. As can be seen in the Department of Energy’s unclassified movie, “Systems Under Fire,” there are readily-available and low-cost means of defeating these weapons such as pre-detonation screens.

We also understand that the Commission has voted down the staff’s recommendation to require nuclear power plant security to protect against a number of other common lethal weapons – including ones that have been around for close to 100 years and others currently being used by terrorists around the world. These weapons include bangalore torpedoes which will blow apart a double fence in a few seconds; platter charges that travel at 6000 feet per second and will penetrate at least six feet of reinforced concrete because it imparts millions of foot pounds of energy; and 50 caliber Armor-Piercing Incendiary (API) rounds.

As you know, it would only take terrorists 45 seconds to get from the alarmed double-fence line into many of the Pressurized Water Reactors spent fuel pools. And it would only take minutes to blow a hole in the bottom of the pool with one of these explosives, creating what the National Academy of Sciences describes as potential serious release of radiation. We have consulted a variety of experts, such as a national guardsman with special operations training who was called up after 9/11 to protect an East Coast nuclear power plant. After some assessment, he told POGO that, with a .50 caliber rifle with API rounds from a single location outside the facility’s perimeter, he could have easily destroyed most of the Bullet Resistant Enclosure guard towers. Many of the plants’ security officers refer to these towers as “iron coffins.” DOE has ceased using even state-of-the-art guard towers because of their vulnerability, yet nuclear plant licensees are relying on them more frequently.

Finally, the NRC needs to upgrade its stewardship of highly-enriched uranium (HEU), at Nuclear Fuel Services in Erwin, Tennessee, and the Nuclear Products Division of BWXT in Lynchburg, Virginia, as well as at university research reactors that use HEU. There is no reason why the Erwin and Lynchburg facilities should have a DBT any less than DOE requires of its Category I (weapons quantities of weapons-grade material) facilities. While university research reactors may not individually contain enough HEU to make a bomb, a combination of two university reactors could. HEU is, without question, a terrorist’s weapon of choice. It is the easiest ingredient to use to make an Improvised Nuclear Device (a crude nuclear bomb), which could be as large as 10-kilotons – one that has the same yield as the nuclear bomb used on Hiroshima. As a result, securing all sources of HEU must be given the government’s top priority.

POGO’s concerns regarding the NRC’s inadequate DBT are not alarmist, and are based on real threats. As the 9/11 Commission confirmed, terrorists have considered targeting nuclear power plants in the past, including Indian Point which is less than 50 miles from New York City. In fact, in his 2002 State of the Union Address, President Bush confirmed that U.S. forces “found diagrams of American nuclear power plants” in caves used by al-Qaeda in Afghanistan.

Clearly, the Attorneys General from New York, Connecticut, Illinois, Arkansas, Arizona, and Wisconsin – states that are home to numerous nuclear power plants – do not believe that the NRC’s DBT is adequate. As they urged the NRC in January 2005, “amend [federal regulations] to require nuclear power plant owners to prepare to repel air, water or land assaults by a group at least as large as the 19 terrorists who acted on 9/11, attacking at more than one point at the same time and using any appropriate weapons, means of sabotage and vehicles.”

If there is an attack on a nuclear plant with the weapons and tactics described – weapons and tactics against which the Commission decided were not important to defend – NRC records will reveal to the public exactly who on the Commission dismissed the actual threat the professionals knew existed. Something to consider.

POGO continues to request a meeting with you in order to discuss a range of issues that concern us. We believe the NRC is abdicating its responsibility to the public and needs to make significant improvements right away. I look forward to your response.

Sincerely,

Danielle Brian

Executive Director