Outside Responders: What Help Can They Offer?(1)Preventing any successful theft or act of sabotage by one or two armed individuals or a group of unarmed people.
(2) Delaying the attack of an armed group up to squad size sufficiently long to allow notification of and response by law enforcement authorities so that the attempted theft or sabotage is thwarted or stolen material is promptly recovered.
(3) Defending itself in the event of a well-planned attack, executed in a disciplined and organized manner sufficiently well to communicate with law enforcement authorities to advise them of the attack and its scope and furnish information to be used as a basis for countermeasures and a properly escalated response by local, State or Federal counterforces either to prevent removal of the material or recover it or to initiate appropriate post sabotage action.32
The utilities confirm that their role is simply to interrupt and delay the attackers until outside help arrives. "Delay is the name of the game," said Wayne A. Trump, manager of security at Peach Bottom nuclear plant in Pennsylvania. "We fall back, protect and call in outside help."33
Don Mothena, manager of plant services for Florida Power & Light, also explained, "Our job is to provide sufficient delay, so that we can get local law enforcement support to aid us. This is not meant to be a long-term battle. It's meant to be something where you recognize that you have a problem, you yell quickly, you yell loud, and you get additional resources to help you perform the important task of protecting the power plant."34
The NRC is only just recognizing that there is a chasm between how long plant security can hold off an attack and when outside responders will arrive. "Where are the lines?" asks Roy P. Zimmerman, director of the NRC's new Office of Nuclear Security and Incident Response. "Where is it that the utility has responsibility, and where is...the responsibility for various levels of government?"35
It is unrealistic to believe that the nuclear plants can depend on outside help to defeat a terrorist attack. The consensus among those security experts who POGO consulted is that a suicidal attack on a nuclear plant aimed at the reactor or spent fuel pools would be over, one way or the other, in 3-10 minutes. In fact, people familiar with NRC OSRE's tell POGO the mock attacks are usually lost in three minutes. One guard said that his own utility security manager admitted that if something happened, "they (the terrorists) would come trained to the hilt, and the plant would be wiped out in 20 minutes." (Appendix Addendum H)
Some guards believe, and top NRC officials acknowledged to POGO, that tabletop exercises indicate it would take one-two hours for outside responders to arrive on the scene prepared to try to take back the plant from terrorists. These tabletop exercises evaluating response times only began in July 2002. (Appendix D, L and P)
The delay results from the actions that must take place if an emergency call were made from a nuclear power plant that was under attack and in need of backup to outside responders. These actions are:
The Department of Energy (DOE) had experience with this process at Lawrence Livermore National Labs in California when, in the mid-1990s, it disbanded its in-house SWAT team for budgetary reasons and was dependant on the SWAT capabilities of the Alameda County Sheriff's Department. When DOE performance tested this arrangement in a force-on-force test, they found it took the Sheriff's SWAT unit two hours to arrive at Livermore - long after the attack was over. Livermore reestablished its own SWAT team.
A number of guards and government and private nuclear power security experts interviewed by POGO indicated that the utilities have never performance tested the length of time it would actually take for an outside responder SWAT team to arrive. While the NRC has recently begun a pilot program to test these timelines, it is only performing tabletop exercises rather than actual drills. The few live exercises that have been sponsored by the Federal Emergency Management Agency and the NRC have focused on a nuclear accident, the response to which is not at all comparable to the response which is required by a terrorist attack. These live exercises, which focus on evacuation procedures and medical and HAZMAT technicians as outside responders, can tell us little about how long it would take SWAT units to arrive and how they would interact with guard forces in the event of an attack.
Some guards indicated they believe a few State Police or local sheriffs' deputies could respond in 10-20 minutes. However, these responders do not constitute a combat force, do not carry automatic weapons, and are not familiar with plant layout or the target sets to be protected. (Appendix B, C, D, E, F, K and L)
Any number of issues arise when an outside SWAT unit actually arrives at the plant:
NRC officials currently accept the two-hour delay in response time because they believe it would take at least an hour or two after an attack before irreversible core meltdown would occur. Nuclear operators are assumed to have sufficient time to manipulate the controls to prevent significant core damage. The NRC has performed no analysis, however, to support this assumption. An NRC Commissioner explained to POGO that this assertion is based on a conversation with a Japanese nuclear regulator. NRC officials admit, however, that if the terrorists or an "active insider" disables the reactor controls and their back-up, there would be nothing outsider responders could do.
The best real-life example of the chaos that ensues during a security emergency was in 1993, when a deranged individual broke into the protected area at Three Mile Island and for four hours could not be found. During that incident, according to the NRC's own analysis of the event:
"while the intruder was at large . . . (P)ersonnel safety considerations also prompted a decision not to staff the normal designated in-plant technical support center or the operations support center which are located in the control tower. . . . The licensee focused on re-establishing the security of the facility and eliminating the intruder, thus obscuring the broader emergency response measures required for potential radiological sabotage."36
The operators abandoned the prescribed procedures during the event, even though there was no direct threat to them - no gun shots or grenade explosions. In other words, the nuclear operators who were supposed to prevent core damage by taking corrective action had the human reaction of placing their personal safety over their emergency duties of preventing radiological sabotage. The Nuclear Control Institute makes the point, ". . . there is no evidence that operators have the necessary training to cope with the complex set of events that could occur during an attack. Destruction of an entire target set typically corresponds to a 'beyond-design basis' accident, which is likely to be beyond the effective control of operators or mitigation systems."37 This event suggests the NRC should reconsider its belief that the nuclear operators will perform heroically and risk personal safety while under attack for two hours before outside responders can arrive.
Federal Government Oversight: Dumbed-Down NRC Mock Attack Tests and Design Basis Threat
The Design Basis Threat (DBT) specifies the number of outside attackers and inside co-conspirators that nuclear facilities must be able to defeat. According to the Code of Federal Regulations, the DBT mandates that the guard forces be capable of fending off several attackers. The Code is not specific and does not define "several," but a number of publications have reported that the NRC is only protecting against three terrorists who would attempt to penetrate a plant.38 This number is highly unrealistic in light of the 9/11 attack. The DBT also specifies the weapons attackers might use and states that the plants should assume they would have the help of an informed accomplice known as a passive "insider" who would provide information, or even an active "insider" who would "facilitate entrance and exit, disable alarms and communications, participate in violent attack."39
While the NRC has become more concerned about the active and passive insider threat, the utilities are downplaying it, claiming that background checks and other personnel reliability programs negate the possibility of an insider. Notably, however, virtually all of America's known spies have been trusted insiders with the highest security clearances in the government - most recently Robert Hansen and Aldrich Ames. Therefore, background checks and personnel reliability programs have not solved the insider problem. To further challenge industry assurances that an "insider" is implausible, Representative Edward Markey (D-MA) revealed that "the NRC does not know how many foreign nationals are employed at the nuclear reactors, and does not require adequate background checks of nuclear reactor employees that would determine whether an employee was a member of a terrorist organization."40
At the beginning of the OSRE test, the NRC performs board games or paper simulations called "tabletop" exercises to evaluate whether or not the tactical response of the security force can protect the plant. Typically, a tabletop exercise is a good first step in determining the effectiveness of the size and tactics of the guard force. However, the NRC should require (but doesn't) the use of Joint Tactical Simulation (JTS) computer modeling. JTS injects more realism into tabletop exercises and is used extensively by the military and Department of Energy. The fact that the 65 nuclear power sites have not invested in JTS is evidence that the utilities place more value on cost savings than on providing adequate security. In fact, POGO was told by a federal official that the utilities which operate the Oyster Creek and Limerick plants, rather than using the higher-tech, more realistic approach, rely on the rudimentary system of moving colored clothespins on a board to symbolize the actions of terrorists and guards.
To actually test the security forces, the NRC conducts mock terrorist attack tests which are run by the Operational Safeguards Response Evaluation (OSRE) program. Prior to 9/11, these mock attack tests occurred only once every eight years. A few days before the one-year anniversary of 9/11, the NRC issued a press release announcing that it is planning to begin conducting these tests every three years.41
In the months leading up to a mock attack test, the utilities hire security-training consultants and additional guards to improve their security posture and chances of success. Even a nuclear industry representative acknowledged that utilities spend "millions of dollars" getting ready for the tests.42
The guards said that for months prior to a test, they repeatedly practice for the two or three scenarios on which they will be tested, often with the help of the consultants. The problem, according to the guards, is that they train only on the particular attacks that will be used in the test rather than on many different types of attacks. Once the tests are completed, the security consultants are let go and the guard force reduced until the next test. (Appendix C, E, H, I, J, K, and M)
Between 1991 and 1998, OSRE tests were conducted at 57 sites. The NRC Director of Operations wrote to NRC commissioners, "... OSRE teams identified weaknesses at 27 plants; some of these weaknesses related to failures to prevent mock adversary forces from gaining access to vital equipment."43
In 1998, the NRC terminated the OSRE program during a budget battle with Congress, presumably because these tests repeatedly delivered bad news. After the Los Angeles Times broke the story and the non-profit Committee to Bridge the Gap and Representative Markey raised a fuss, the White House became involved and the testing program was reinstated.44
When the mock force-on-force tests resumed, the news was no better. NRC Chairman Meserve himself admitted,
"In 37 of 81 OSREs [46% of the security tests] conducted between August 1991 and August 2001, the NRC identified weaknesses. For those plants at which a weakness was found, the attacking force was typically able in one of the four exercises to reach a target set and simulate destruction of that equipment. ... the utility's performance is judged unsuccessful for the scenario if the response force is not able to prevent the adversary from disabling and/or destroying all pieces of equipment/actions in a target set. ... Historically the OSRE team based its conclusions concerning weaknesses in the utilities' response strategies on whether the utilities had the capability (1) to respond with a sufficient number of armed personnel, (2) who were appropriately armed, (3) to protect positions, (4) in time to interdict the adversary before the adversary completed its attack. Cases in which a utility was unable to satisfy one or more of these criteria would indicate that the adversary could cause an act of sabotage resulting in a loss of a complete target set (i.e., the equipment necessary to be protected to prevent core damage)."45
In other words, according to then-OSRE program manager David Orrik, even with adequate time for the plants to prepare and make themselves ready for the OSRE, 46% of them still had a weakness in armed response which allowed the mock terrorists access to parts of plants where a real act of sabotage could have led "in many cases to a probable radioactive release."46 If a facility fails a test, it is allowed to continue operating.
OSRE tests have been on hold since 9/11 and are not expected to resume until early 2003 - 18 months after 9/11.
In a real attack, the one overwhelming advantage terrorists would have is the element of surprise. During these mock drills, however, this element is completely missing and no effort has been made to compensate for it. Another important artificiality of these tests is the missing chaos and violence that would take place during a real terrorist attack - grenades exploding in relatively close quarters in buildings, human carnage, and other unanticipated events.
Yet another artificiality of force-on-force tests involves "combat effectiveness." Military doctrine dictates that when losses exceed 20%, forces become combat ineffective due to loss of command, communications and basic squad-sized tactics. As the OSRE tests typically do not recreate this "fog of war," the guard forces are not tested under the realism of watching their colleagues be maimed or killed around them. As an Army Special Forces Commander wrote:
"As a unit sustains casualties (dead or wounded) elements of the fire and maneuver schemes or 'close quarter battle' drills begin to come apart. ... [I]f casualties are high (in excess of 10%) qualified replacements become increasingly problematic and command and control begins to be lost. Units are normally considered 'combat ineffective' and are rotated off the line when they have sustained 15-20% casualties. ... Continuation would be expected to result in unnecessary and increasingly high casualties with little expectation of success."47
POGO was told by one nuclear power plant guard with military experience, that he raised this problem with management, but the plant has not addressed it. (Appendix E)
Prior to 9/11 the NRC agreed to pilot a Safeguards Performance Assessment program that permitted less direct involvement by the OSRE office in conducting security tests and more industry self-assessment of security. The idea has not yet been implemented, but it is both telling and alarming that the NRC ever even considered giving the utilities that much latitude, particularly in light of their resistence to the guards' concerns.
The most significant problems with the NRC mock attack tests are:48
Despite this dumbing-down of the OSRE tests, the utilities, and the NRC, itself complain that they are in fact too difficult. NRC Chairman Meserve described them as "very hard tests."50 For example, according to NRC insiders, during an OSRE force-on-force at Oyster Creek one of the mock terrorists took the badge off a "dead" guard, and used the badge to enter a building unchallenged. The utility was furious, complaining to NRC Commissioners that this was cheating because such a tactic had not been scripted.
Despite the clear imperfections that favor the guard forces, credible force-on-force tests are still one of the best measures of the performance of a guard force in protecting a nuclear facility. Utilities can approach these exercises as a necessary and important part of running a nuclear power plant. For example, in 1998 the manager of security at the San Onofre plant pointed out, "Conducting your own drills is like a practice session. Operational Safeguards Response Evaluations was like the big game."51
NRC Turns Blind Eye to Spent Fuel Pools
The NRC has never performance tested a power plant guard force's ability to protect spent fuel pools - possibly the prime target of a terrorist attack. In October of 2000, the NRC started to recognize the problem of spent fuel fires in a study of the effects of accidents. However, in over 100 pages of analysis, they never considered sabotage by terrorists.52 The vast majority of spent fuel pools are outside the containment buildings. Several spent fuel pools at nuclear power plants across the country are only about 50 yards from the double fence line. Some of the guards estimated that a terrorist could penetrate the fence line and the spent fuel pool, in 20 to 60 seconds.(Appendix B, E, G, and N)
POGO has been advised by military Special Forces sources of specific and obvious vulnerabilities at the spent fuel pools at most nuclear power plants. To explain in general terms, a certain type of explosive, which a terrorist could carry on his back, would allow him to blow a sizeable hole in the reinforced concrete bottom or wall of a spent fuel pool. At nuclear plants that have boiling water reactors (about one-third of existing reactors) things could be even worse. In these cases where the spent fuel pools are above ground and not inside the containment building, a certain kind of explosive could be launched from outside the fence line into the side of the pool - the terrorists would not even have to enter the secured area.
According to an unclassified study by Brookhaven National Lab, under certain conditions the pool would start draining immediately. This could result in the immediate release of high levels of radiation, quickly turning into an uncontrolled radioactive fire, and the plant could do nothing effective to stop it. This report found that a severe fire in the spent fuel pool could render about 188 square miles uninhabitable, cause as many as 28,000 cancer fatalities, and cost $59 billion in damage.53
Both the October 2000 NRC staff report and the Brookhaven report were embarrassing for the NRC. In a recent meeting with an NRC Commissioner, POGO was told that the calculations of both reports were not endorsed by the Commissioners, and will be redone.
In addition to the NRC studies, other experts have calculated clearly that spent fuel pools could be targets of opportunity and could result in catastrophic radioactive fires if the water were even partially drained from the pools. The NRC concedes that such a fire cannot be extinquished: it could rage for days. The Institute for Resource and Security Studies determined, "If a fire were to break out at the Millstone Reactor Unit 3 spent fuel pond in Connecticut, it would result in a three-fold increase in background exposures [over natural radioactivity]. This level triggers the NRC's evacuation requirement, and could render about 29,000 square miles of land uninhabitable."54
Decommissioning Reactors : NRC's Poor Stepchild
There are 12 decommissioning nuclear reactors in the United States. There is no longer fresh nuclear fuel in these reactors, and therefore the reactor containment domes would not be a desirable target for a terrorist attack. However, there are still hundreds of tons of spent fuel in the pools at these reactor sites.
Because it was believed, by the NRC that spent fuel and particularly older spent fuel was no longer a potential target of a terrorist attack, the NRC allowed the power companies to virtually "gut" the security at the decommissioning plants, as one guard put it. According to this guard, the utilities were allowed to take the alarms off the fences, eliminate semi-automatic rifles and shotguns, and significantly reduce the guard force. Prior to 9/11 there was even a plan to move to unarmed guards. The site would then be totally dependent on outside responders. In one case, those responders would be six state police troopers with handguns and a few shotguns to respond to the attack. The response time would be from 30 minutes to an hour - long after an attack would be over. Since 9/11, at least one of the guard forces has been re-issued shotguns. However, they have never had an exercise with the state police. Keep in mind, the terrorists would likely be attacking with automatic weapons, explosives, long-ranged sniper rifles and other advanced weaponry, for which a shotgun is no match. (Appendix B)
Letting Utilities Focus on Compliance Rather than Performance
The mindset of both the utilities and the NRC is heavily compliance-oriented. If a utility has submitted a security plan to the NRC that meets requirements such as the presence of a double-fence, alarms and a certain number of guards, it feels confident to boast that it is secure. However, the NRC mock attack performance tests repeatedly reveal that despite compliance with requirements, many guard forces could not repel even a mock terrorist attack.
Several guards told POGO that when they raise security concerns with their utility, they are regularly told that security upgrades are unnecessary because the utility is already in compliance with NRC regulations. As one guard put it, "...but compliance doesn't mean you can stop a terrorist." (Appendix H, I, J, L, M, and P)
For example, nuclear plants are "in compliance" as long as they require annual weapons qualification. As a result, annual requalification is the only opportunity many plants give guards to train with their weapons.
The utilities are also more focused on compliance with NRC regulations than performance when it comes to the fitness for duty of the force guarding the plants. The utilities and their security subcontractors are regularly forcing guards to work up to 72 hours per week, the maximum number of hours allowed by the NRC, despite the compromised security that results from a heavily-fatigued guard force which has worked six consecutive days of 12-hour shifts. Although a 72-hour work week is only supposed to occur under extraordinary circumstances, the utilities are still in compliance even though they are requiring this overtime on a regular basis. (Appendix G and U)
This institutionalized bureaucratic complacency is a major impediment to adequate security. A post-9/11 example of this phenomenon is that armed guards are now required to accompany all visiting trucks coming onto nuclear power plant sites. That sounds wise, but POGO has been told that there are often no extra guards available for that duty and therefore guards leave their post unmanned to accompany the trucks. In situations such as this, the facility may be in compliance, but guards are concerned that there is a hole in their defensive posture. (Appendix H, I, and J)
Inadequate Whistleblower Protections
While some guards have reported their security concerns to management and regional Nuclear Regulatory Commission offices, many have not. Retaliation by a utility and/or its contractors against whistleblowers is a reality. Even under the best circumstances, a guard is risking his job in order to report security concerns. In POGO interviews, guards repeatedly expressed their fear of being fired or retaliated against for publicly expressing their concerns about security weaknesses. Indeed, during the course of its investigation, POGO learned of two guards who were fired in recent months by Wackenhut after expressing concern about their ability to remain alert while on duty as a result of fatigue-causing 72-hour work weeks. Although several laws provide whistleblower protections, they have clearly failed to alleviate the chilling effect of the corporate security contractors' heavy hand aimed at silencing concerned guards.
Two statutes in particular allow nuclear power plant security guards to seek reinstatement of their jobs and lost wages if they have experienced retaliation for blowing the whistle. The first is Section 211 of the Energy Reorganization Act (ERA), which provides any employee working for a nuclear power or weapons facility, either as a full-time employee or a contractor, the right to seek remedies for whistleblower retaliation. The ERA is considered a stronger statute in comparison to other environmental whistleblower protection statutes because it allows the NRC to investigate prevailing whistleblower retaliation cases in order to root out the sources and causes of retaliation. In addition, the burdens of proof are much fairer to the whistleblower under ERA than under the whistleblower provisions of the Clean Air Act and Clean Water Act. However, the appeal process for ERA whistleblower cases leads into administrative proceedings at the Department of Labor (DOL) where cases can languish for months and even years (for example, whistleblower Casey Ruud's case has taken 14 years and is still ongoing). This situation makes it difficult for whistleblowers to obtain relief. As a result, there is enormous pressure on most ERA whistleblowers to settle their cases rather than fight to the bitter end.
The second statute, the 2002 Corporate Accountability Act, now provides protections to guards and other nuclear power plant employees working at publicly traded corporations. One of the most positive aspects of the Act is that if the DOL does not issue a ruling on an appealed whistleblower case after 180 days, the whistleblower has the right to a jury trial in a U.S. District Court. This prevents DOL from becoming a black hole as has often happened in ERA whistleblower cases. Similar to the ERA, the legal burdens of proof under the Corporate Accountability Act are much more fair to the whistleblower than other environmental whistleblower protection provisions.
Recommendations
1. The NRC should:
2. The OSRE staff should:
3. The NRC should require utilities to:
4. Congress should:
Home I Archives I Expose I Search I Donations I Investigations I About Us I Contact Us I Press Room
Site Map I Web Overseer I Site Policies
---
© The Project On Government Oversight 2002
updated:
