Championing Responsible National Security Policy

Speech by POGO's Danielle Brian, before the Regulatory Information Conference of the Nuclear Regulatory Commission

The Project On Government Oversight (POGO) is an investigative organization that works with inside sources to improve public policy. Founded in 1981, POGO is a politically-independent, non-profit watchdog that strives to promote a government that is accountable to the citizenry. In early 2001, POGO began its first investigation into nuclear security after more than a dozen high-level Department of Energy (DOE) security experts came forward with concerns regarding inadequate security at the DOE's nuclear weapons facilities. Just prior to September 11, 2001, POGO completed that investigation, concluding that the nation's ten nuclear weapons facilities, which house nearly 1,000 tons of weapons-grade plutonium and highly-enriched uranium, regularly fail to protect this material during mock terrorist attacks. The resultant report, "U.S. Nuclear Weapons Complex: Security at Risk," was released in October 2001. Since the report's release, Congress, the General Accounting Office, and several federal agencies have undertaken reviews of POGO's findings, which are still ongoing. In the meantime, the DOE has put into motion a plan to relocate tons of bomb-grade nuclear materials from one of three facilities POGO profiled for immediate attention. The DOE has also upgraded the security posture to "denial" at those facilities where an Improvised Nuclear Device could be detonated -- this means that they simply cannot allow terrorists to enter these facilities because terrorists could create a nuclear detonation in minutes.

Because of this work at nuclear weapons facilities, several current and former guards from commercial nuclear power plants began contacting POGO in early 2002 with similar concerns about inadequate security at the nation's nuclear power plants. POGO takes no position on nuclear power. POGO expanded our investigation, and have now interviewed over 150 guards at more than 30 plants. In an effort to corroborate these interviews, POGO consulted security specialists with military backgrounds who test and evaluate security at commercial reactors, current and former NRC and other federal security officials, contractors, and a National Guard supervisor who is supplementing security at a nuclear plant. These experts shared most of the guards' concerns about security at the nation's nuclear power plants.

In our ensuing report, "Nuclear Power Plant Security: Voices from Inside the Fences," POGO found that nuclear power plant security guard forces are often undermanned, underpaid, under-equipped, under-trained and unsure when to use deadly force. As you know, the Nuclear Energy Institute had been running advertisements in The Washington Post, The Hill and other inside-the-beltway news sources often read by legislators depicting burly, intimidating plant guards in flak jackets with semi-automatic weapons in hand and who were described as "well qualified, highly-trained, well-armed and well-compensated." At the time the ads were running, however, the guards were often more than a football field's distance away from their flak jackets and their guns, which at many plants were simply pistols and shotguns, and at some plants still are. Since then, the NRC has required licensees to carry their weapons, which were in many cases finally upgraded to semi-automatic weapons. When our report was first issued last fall, the NEI was quick to dismiss our findings, tepidly complaining that our samples were too small to be representative. Fortunately, the NRC broke with its tradition and looked for itself.

Despite NEI's assurances to the contrary, the NRC found power plant security to be so inadequate that it stepped in to enforce stricter requirements for training and excessive use of overtime. Meetings are now being held by the NRC to revamp training orders for the guards. It is ironic that, despite the NEI's claims that guards are well trained, these meetings were closed to the public, including non-governmental organizations like POGO, because discussing the guards' lack of training would expose the vulnerability of the plants to the public.

The NRC is also addressing the problem of security guard fatigue, caused by ridiculous work schedules. How alert and capable of repelling a terrorist attack would you be after working 60 hours -- let alone 72 hours -- a week, and for months on end, at that? POGO applauds the NRC's efforts toward improvement; however, it should not have taken our report to illuminate its failures. Had they not been relying so much on industry propaganda, NRC regulators would have found these failures on their own.

POGO's findings are consistent with both NRC and industry assessments. In testimony before the House Energy and Commerce Committee, David Orrick, the head of the Operational Safeguards Response Evaluation (OSRE) program, stated that 46% of plant guards did not pass the performance tests that already are seriously dumbed down to favor the guard forces. I know this statistic is controversial, but let's face it: If there are four tests and a plant "only" fails one, it still means the terrorists got in, disabled the safety and security systems and caused a catastrophic event. It only takes once. Entergy's own investigation found that only 19% of guards at Indian Point felt they could adequately protect the plant post 9/11. Entergy's results were strikingly similar to POGO's on this issue.

It is important to note that security at various plants is not equal. We did find that guards at about 25% of the plants believed they could repel a terrorist attack. This is an important first step, but even those guards acknowledge that without independent force-on-force performance tests of the guard forces and defensive strategies, they don't know how well they would fare. As you know, there weren't any NRC-conducted force-on-force tests since 9/11 until just a few weeks ago when one was conducted at D.C. Cook, and another at Comanche Peak was scheduled but cancelled because of bad weather -- as if there are only fair-weather terrorists. However, these tests are still being conducted using rubber guns and whistles and inexperienced "controllers" -- secretaries and maintenance workers from the utilities. The adversarial forces are simply guards from another plant who have no training in adversarial tactics. It is untenable that at this late date, such unprofessional, amateur testing can pass as a true measure of assessing security.

While the NRC has addressed two areas of concern, fatigue and training, we urge them to examine two other, equally important, facts: the guards are under-equipped and underpaid. Because the security guards are employees of private companies, state laws limit the type and grade of weaponry with which they can be armed. At the time the NEI ads were run, one-third of the plants had shotguns but no rifles, and the weapons were typically locked up in a central location. Even if the guards were trained to use them, these weapons don't even have the range necessary to respond to the high-tech weapons most likely to be carried by terrorists: Sniper rifles, automatic weapons, rocket-propelled grenades and a range of explosives. Since the NRC's February 2002 order, the vast majority of plants now have guards carrying semi-automatic rifles. While an improvement, guards still need far more ammunition available, bigger clips, and automatic weapons to be a match for terrorists. Unfortunately in many cases, state laws prohibit private security forces from being so armed.

While we have not taken a position on federalizing the security force, federalizing security at nuclear power plants may be the only way to address state limitations on weapons carried by guards. NEI claims that if security jobs were to be federalized, many officers would quit. However, retention of guards is already a serious problem. In fact, any number of current guards and trainees are leaving their power plant jobs to work for the new Transportation Security Administration, or for state and local law enforcement. Yet again, NEI's claims do not hold up to scrutiny. At a recent NRC meeting on the proposed fatigue order, industry representatives claimed they needed several months to increase the size of their security force because of difficulty hiring and retaining guards. Guess why? Long hours and low pay. One of the many guards who have communicated with us since the release of our report recently made this poignant observation: While he fully supports the NRC's move towards the Fatigue Order for increased security at his plant, he wonders how many of his colleagues will be able to afford to live without the overtime they need to compensate for their low hourly wages. This leads us to the next, and perhaps most controversial issue -- wages and benefits.

Improving guard wages and benefits may be the most important issue because, once remedied, it would help solve many other problems. The guards work too many hours because the force is not large enough. This small force is in part a result of the high turnover rate caused by low wages. The long hours and paltry compensation have resulted in a serious morale problem at many of the plants. When asked, guards sometimes admit they have no intention of sticking around if an attack were to occur. Right now, three companies employ guards for most of the nuclear power plants in the U.S. These three companies have saved money for the utilities by paying lower wages. In some cases, guards are making less than they were eight years ago! Guards at many plants including Browns Ferry, Sequoyah, Watts Bar, Salem and Hope Creek, Monticello, Prairie Island and Vermont Yankee all make less than the custodians at their plants. If guard salaries increase, the plants will attract more qualified guards and reduce the turnover rate. Unfortunately the bottom line is the bottom line. Utilities simply have been unwilling to spend what is necessary to adequately protect the plants because security is seen as a drain on profits. Once the NRC begins frequent realistic force-on-force testing with real sanctions for poor performance, licensees will be forced to make security a priority. I believe that once the controllers are not drawn from management, the mock terrorists are played by trained adversarial forces, and there is a real disincentive to losing OSRE's, licensees will pay for adequate security because failure to do so means they might have to shut down until NRC-identified security problems are remedied.

The nuclear power industry and the NRC have repeatedly demonstrated their unwillingness to respond to guards' concerns. Recently, NRC Commissioner McGaffigan heard over 40 guards voice their concerns at a private meeting arranged by POGO. This meeting was an eye opener for him. It was also an eye-opener for us - the meeting made clear how little information about security problems had previously made it to the Commissioner level. Ongoing concerns reported by guards to their own management and NRC Regional offices appear to have been buried for years. Security guards do not have adequate representation to communicate their concerns in Washington. Because guards do not have a voice in Washington, they are not able to set the record straight when they are repeatedly used by industry as an advertising tool to mislead both Congress and the NRC. To make the guards' concerns known, they need a strong voice.

When they do speak loud enough to be heard as individuals, they are punished. At Indian Point, security guard Foster Zeh was put on administrative leave after his concerns prompted Entergy to investigate the plant's security measures. Entergy reported that 59% of Indian Point guards admitted that a "chilled environment" exists between security guards and management. In February of 2001, the U.S. Secret Service and NRC Inspector General raided Region IV offices. Whistleblowers within the offices had tipped them off about criminal activity occurring within the offices. Appallingly, after three NRC employees were arrested and convicted as a result of the information the whistleblowers disclosed the whistleblowers were fired! The NRC's Inspector General also recently determined that 47% of NRC employees believe it is not "safe to speak up in the NRC." As a result of this environment, I strongly support whistleblower protection legislation so that wrongdoings can be reported without fear of retaliation. POGO also recommends that the NRC makes direct communication between the guards and the Commission an immediate priority.

Non-Governmental Organizations (NGOs) also need to get far more involved to counter the NRC's tendency to listen only to the regulated parties who are likely to give them only good news, and not to whistleblowers or public stakeholders who may be bringing bad news regarding security issues. David Lochbaum, National Safety Engineer for the Union of Concerned Scientists, recently testified before the House Subcommittee on National Security about, among other things, the NRC's refusal to meet with him. He had requested a meeting on numerous occasions, clearly expressing that his goal was not to obtain sensitive security information. Rather, he sought an opportunity to articulate UCS's concerns about nuclear plant security so the agency could pay them due consideration when making decisions regarding, in his words, "what very well may be the most important public policy issue of this new millennium." In his testimony, after detailing the industry's shortcomings, including working hour limits and training standards, Mr. Lochbaum stated that "the NRC would have known about these, and other, security problems sooner had it simply allowed input from public stakeholders." The inclusion of NGOs is essential for forcing change in an otherwise defensive industry.

While the NRC is taking some measures to ensure increased security at nuclear power plants, many remain to be taken. Eighteen months after 9/11, the NRC appears to be wallowing: In addition to the issues we've raised above, there is no new Design Basis Threat (DBT), only a couple of gentle force-on-force performance tests, and no improvement to spent fuel pool security. Both industry and the NRC claim legislation is not needed. Despite some progress by the NRC, due largely to the glare of public scrutiny, I believe when the public and Congress inevitably become more complacent down the road, efforts to eliminate independent testing and allow the nuclear industry to regulate itself will return. As a result, I firmly believe legislation is necessary to permanently establish common sense security standards which have been, until now, inexcusably absent.

Right now, no one is saying, "It is my job to protect this plant in the event of a terrorist attack." Industry argues that they are not responsible for defending against an enemy of the state. What a meaningless statement. If terrorists are flooding through the fences with a full array of weaponry, are the guards expected to ask the attackers for their passports to determine whether they are enemies of the state? Either the utilities can protect the plants against a realistic DBT or they can't. If the industry refuses to take the responsibility, then the government should federalize the forces and charge the cost to the utilities.