[Senate Hearing 110-181]
[From the U.S. Government Publishing Office]


                                                        S. Hrg. 110-181
 
    DIRTY BOMB VULNERABILITIES: FAKE COMPANIES, FAKE LICENSES, REAL 
                              CONSEQUENCES 

=======================================================================

                                HEARING

                               before the

                PERMANENT SUBCOMMITTEE ON INVESTIGATIONS

                                 of the

                              COMMITTEE ON
               HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
                          UNITED STATES SENATE

                       ONE HUNDRED TENTH CONGRESS

                             FIRST SESSION

                               __________

                             JULY 12, 2007

                               __________

        Available via http://www.access.gpo.gov/congress/senate

                       Printed for the use of the
        Committee on Homeland Security and Governmental Affairs

                               ----------
                         U.S. GOVERNMENT PRINTING OFFICE 

STAR PRINT 37-358 PDF            WASHINGTON : 2007 

For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
Washington, DC 20402-0001 











































        COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

               JOSEPH I. LIEBERMAN, Connecticut, Chairman
CARL LEVIN, Michigan                 SUSAN M. COLLINS, Maine
DANIEL K. AKAKA, Hawaii              TED STEVENS, Alaska
THOMAS R. CARPER, Delaware           GEORGE V. VOINOVICH, Ohio
MARK PRYOR, Arkansas                 NORM COLEMAN, Minnesota
MARY L. LANDRIEU, Louisiana          TOM COBURN, Oklahoma
BARACK OBAMA, Illinois               PETE V. DOMENICI, New Mexico
CLAIRE McCASKILL, Missouri           JOHN WARNER, Virginia
JON TESTER, Montana                  JOHN E.SUNUNU, New Hampshire

                  Michael L. Alexander, Staff Director
     Brandon L. Milhorn, Minority Staff Director and Chief Counsel
                  Trina Driessnack Tyrer, Chief Clerk


                PERMANENT SUBCOMMITTEE ON INVESTIGATIONS

                     CARL LEVIN, Michigan, Chairman
THOMAS R. CARPER, Delaware           NORM COLEMAN, Minnesota
MARK L. PRYOR, Arkansas              TOM COBURN, Oklahoma
BARACK OBAMA, Illinois               PETE V. DOMENICI, New Mexico
CLAIRE McCASKILL, Missouri           JOHN WARNER, Virginia
JON TESTER, Montana                  JOHN E. SUNUNU, New Hampshire

            Elise J. Bean, Staff Director and Chief Counsel
    Madelyn Creedon, Counsel to Senator Carl Levin, Armed Services 
                               Committee
  Mark L. Greenblatt, Staff Director and Chief Counsel to the Minority
          Mark D. Nelson, Deputy Chief Counsel to the Minority
               Timothy R. Terry, Counsel to the Minority
                     Mary D. Robertson, Chief Clerk










































                            C O N T E N T S

                                 ------                                
Opening statements:
                                                                   Page
    Senator Levin................................................     1
    Senator Coleman..............................................     2
    Senator Collins..............................................     5
    Senator Akaka................................................     6
    Senator Carper...............................................     7

                               WITNESSES
                        Thursday, July 12, 2007

Gregory D. Kutz, Managing Director, Forensic Audits and Special 
  Investigations; Eugene E. Aloise, Director, Natural Resources 
  and Environment; and John W. Cooney, Assistant Director, 
  Forensic Audits and Special Investigations, U.S. Government 
  Accountability Office..........................................     9
Edward McGaffigan, Jr., Commissioner, U.S. Nuclear Regulatory 
  Commission.....................................................    22

                     Alphabetical List of Witnesses

Kutz, Gregory D.:
    Testimony....................................................     9
    Joint prepared statement.....................................    39
Aloise, Eugene E.:
    Testimony....................................................     9
    Joint prepared statement.....................................    39
Cooney, John W.:
    Testimony....................................................     9
    Joint prepared statement.....................................    39
McGaffigan, Edward, Jr.:
    Testimony....................................................    22
    Prepared statement with attachments..........................    50

                                EXHIBITS

 1. GDirty Bomb Vulnerabilities, Permanent Subcommittee on 
  Investigations Staff Report....................................    75
 2. GComparison Of Valid NRC License And Counterfeit GAO License.   100
 3. GResponse to questions for the record submitted to The Hon. 
  Edward McGaffigan, Jr., Commissioner, Nuclear Regulatory 
  Commission.....................................................   101


                      DIRTY BOMB VULNERABILITIES:
                     FAKE COMPANIES, FAKE LICENSES,
                           REAL CONSEQUENCES

                              ----------                              


                        THURSDAY, JULY 12, 2007

                                 U.S. Senate,      
              Permanent Subcommittee on Investigations,    
                    of the Committee on Homeland Security  
                                  and Governmental Affairs,
                                                    Washington, DC.
    The Subcommittee met, pursuant to notice, at 9:03 a.m., in 
room SD-342, Dirksen Senate Office Building, Hon. Carl Levin, 
Chairman of the Subcommittee, presiding.
    Present: Senators Levin, Carper, Akaka, Coleman, Collins, 
and Warner.
    Staff Present: Elise J. Bean, Staff Director and Chief 
Counsel; Madelyn Creedon, Counsel (Sen. Levin, Armed Services); 
Mary D. Robertson, Chief Clerk; Mark L. Greenblatt, Staff 
Director and Chief Counsel to the Minority; Timothy R. Terry, 
Counsel to the Minority; Ruth Perez, Detailee (IRS); Kunaal 
Sharma, Intern to the Minority; Adam Doyle, Law Clerk to the 
Minority; Rob Strayer and Leah Nash (Collins); John Kilvington 
and Tom Lawler (Carper); and Rick Kessler and Jodi Lieberman 
(Akaka). .

               OPENING STATEMENT OF SENATOR LEVIN

    Senator Levin. Good morning, everybody. I would like to 
welcome our witnesses this morning from the Government 
Accountability Office and the Nuclear Regulatory Commission. 
Senator Coleman, this hearing is a continuation of a topic on 
which you have worked diligently--ensuring the protection and 
control of material that could be used in a so-called dirty 
bomb.
    The material involved in the GAO sting operation that will 
be the subject of the hearing today is not plutonium or highly 
enriched uranium, the materials that could be used in a nuclear 
bomb. But the material that is the subject of the hearing is 
dirty bomb material--that is, radioactive material in sealed 
containers used for a variety of medical and industrial 
purposes that could also be put to nefarious purposes. The 
vulnerabilities that the GAO has identified, and that the 
Nuclear Regulatory Commission has acknowledged, are 
significant.
    Since September 11, 2001, the Nuclear Regulatory Commission 
has rightfully focused its efforts and attention on securing 
the most dangerous quantities of radioactive material--the 
quantities of radioactive material classified as Category 1 and 
2 materials. According to the International Atomic Energy 
Agency, an individual who handled or who was in close proximity 
to Category 1 and 2 quantities of material would probably be 
dead or severely injured in a few minutes to a few hours. 
Category 1 and 2 radioactive materials are subject to 
extraordinarily strict licensing and security requirements.
    Smaller quantities of radioactive materials are classified 
in three additional categories--Categories 3, 4, and 5. An 
individual who handled Category 3 quantities could be 
permanently injured if he or she handled the material for many 
hours or days, with the possibility of death if exposure 
continues for weeks. Category 4 materials are unlikely to 
permanently injure people; and Category 5 quantities would not 
permanently injure people at all.
    The ability of the GAO to creatively avoid the NRC 
restrictions on Category 4 materials in this instance by 
obtaining small amounts of materials that could be aggregated 
into larger quantities to get to Category 3 quantities of 
material is troubling, and that is what happened in this case.
    The NRC has recognized that the out-of-the-box thinking on 
GAO's part did deceive current mechanisms to regulate 
materials. I note that one of the recommendations that 
Commissioner McGaffigan has included in his prepared testimony 
is that the NRC will ``evaluate how to probe for other thus far 
undiscovered vulnerabilities in NRC and Agreement State 
materials licensing programs.'' That is an important approach, 
a good way to try to anticipate problems in advance, and the 
result of this inquiry. It is also a positive note that the 
vulnerability that GAO has identified has resulted in prompt 
reaction by the NRC and that the NRC took steps to address the 
problem identified.
    I look forward to hearing from the GAO about the full scope 
of the vulnerabilities, the ways in which NRC is responding, 
and what more needs to be done. Senator Coleman, I commend you 
and your staff for the persistence that you have shown in this 
matter. As I know Senator Coleman and Senator Collins are 
aware, the defense authorization bill is on the floor, and as 
the manager of that bill, I will have to return to my floor 
duties fairly soon, so I am going to miss most of this hearing. 
I regret that I will miss it because it is an important 
hearing. Then that responsibility will be turned over either to 
a Democrat, if there is one here, if not, it will be turned 
over to Senator Coleman.
    We have two Ranking Members here this morning. I am not 
sure which Ranking Member has preference--the Subcommittee 
Ranking----
    Senator Collins. Subcommittee.
    Senator Levin. Subcommittee, all right. In that case, 
Senator Coleman, it is your time.

              OPENING STATEMENT OF SENATOR COLEMAN

    Senator Coleman. Thank you, Mr. Chairman, and thank you, 
Ranking Member Collins.
    Today's hearing provides a sober reality check. We turn our 
attention to the threat of a dirty bomb attack and whether our 
government's efforts to prevent such a disaster are effective. 
This Subcommittee has been engaged in a 4-year effort to 
bolster the U.S. Government's ability to prevent a nuclear or 
radiological attack on U.S. interests. The Subcommittee's 
efforts have been thoroughly bipartisan, and I appreciate 
Senator Levin's continued dedication to this cause.
    Make no mistake: The threat of a dirty bomb attack is real. 
The executive director of the 9/11 Commission stated in 2004 
that al-Qaeda ``remains interested in using a radiological 
dispersal device or `dirty bomb.' '' Even worse, he said that 
``[d]ocuments found in al-Qaeda facilities contain accurate 
information on the usage and impact of such weapons.''
    The aspiring terrorists that were arrested in London in 
August 2004 sought to construct ``a crude radiological dirty 
bomb.'' In September 2006, the then-leader of al-Qaeda in Iraq 
reportedly called for ``nuclear scientists and explosive 
experts'' to help his terrorist group manufacture 
``unconventional weapons,'' specifically including dirty bombs. 
Sadly, these are just a handful of examples to get a sense of 
the problem.
    In light of this threat, government oversight of 
radioactive materials has become more important than ever. The 
best way to prevent a dirty bomb attack is to stop terrorists 
from getting radiological materials in the first place. Our 
hearing today--along with the Subcommittee's staff report \1\--
will explore some gaps in the Federal Government's regulation 
of radiological materials. In particular, we will address 
weaknesses in the Nuclear Regulatory Commission's 
administration of licenses for radiological materials.
---------------------------------------------------------------------------
    \1\ The See Exhibit No. 1, which appears in the Appendix on page 
75.
---------------------------------------------------------------------------
    As part of its ongoing investigation into homeland security 
matters, the Subcommittee requested that the Government 
Accountability Office conduct a clandestine operation to 
determine whether a terrorist could use a phony company to slip 
under the radar and get a valid radiological license in his 
quest for a dirty bomb. The results are not encouraging.
    In short, GAO created two dummy corporations and applied 
for radiological licenses--one in West Virginia, where the NRC 
regulates radiological materials, and one in Maryland, a so-
called Agreement State that regulates radiological materials on 
its own. Shortly after receiving the application, regulators in 
Maryland embarked on a 7-month review process, requesting a 
site inspection of the company's facilities and interviews with 
its employees. GAO, knowing that this robust review process 
would expose their sting operation, withdrew the Maryland 
application. That is the good news.
    The bad news is that the application that went to the NRC 
was approved in short order. The NRC conducted a cursory review 
and gave a license to GAO's phony company in just 28 days.
    As if that were not bad enough, GAO was able to counterfeit 
the NRC license--using ordinary computer software that any 
teenager could use--to remove the restrictions on the amount of 
radiological materials permitted under the license. In this 
exhibit,\2\ you can see the comparison of the valid NRC license 
on the left and the counterfeited version on the right, and 
essentially what you see is a change in the restrictions on the 
amount of radiological materials that were permitted under the 
license.
---------------------------------------------------------------------------
    \2\ Exhibit No. 2 appears in the Appendix on page 100.
---------------------------------------------------------------------------
    GAO investigators then used copies of the counterfeited 
license to execute contracts to buy enough radiological 
materials to meet the NRC's definition of a ``dangerous'' 
quantity--enough, according to GAO, to build a dirty bomb. 
Perhaps more importantly, investigators could have easily 
prolonged their effort, generating dozens of fake licenses, 
visiting multiple suppliers, and stockpiling significantly 
higher amounts of this--and possibly other, more radioactive--
material. The GAO states that it could have purchased 
``substantially more radioactive source material''--potentially 
enough to reach the NRC's threshold of a ``very dangerous'' 
material. In other words, the modest amount of radiological 
materials that GAO sought to purchase was but a demonstration 
amount. There is no doubt--and I think the testimony will 
demonstrate--that they felt that they could have continued to 
counterfeit, continued to search out suppliers, and acquired an 
even larger quantity of radiological material.
    These weaknesses are not new. In fact, as detailed in the 
Subcommittee's staff report, several entities--including the 
GAO, the NRC Inspector General, and this Subcommittee--have 
recommended over the past few years that the NRC improve its 
licensing procedures to ensure that radiological materials will 
be used as intended.
    To its credit, the NRC has shown a willingness to 
strengthen its licensing process. It made some changes in June 
2007 in response to the GAO's latest clandestine operation. 
Those changes are steps in the right direction--and I applaud 
the NRC for taking them--but I don't think they go far enough.
    I am still concerned that the NRC does not fully appreciate 
the dirty bomb threat. They appear to be focused on the 
accident instead of the crime, on safety instead of security, 
on the good-faith actor in a world of bad-faith people. To be 
fair, focusing on health and safety is obviously a paramount 
concern, and the NRC should be commended for its responsible 
management of the most lethal radiological materials. But in 
this world of sleeper cells and suicide bombers, we must also 
be vigilant about the smaller-scale threat.
    For instance, we think the NRC should regulate so-called 
Category 3 sources more stringently. Category 3 refers to the 
NRC's scale for radioactive sources, which goes from Category 1 
through 5, with Category 1 being the most dangerous 
radiological source amounts and Category 5 the least. I think 
the Chairman laid this out in his opening statement. Category 3 
sources are in the middle range and are designated as 
``dangerous.''
    Under the NRC's previous rules, license reviewers were not 
required to visit the facilities of applicants seeking Category 
3 sources before issuing the license. Instead, the NRC would 
visit those facilities up to one year after the license was 
issued.
    Thankfully, the NRC changed some of its rules soon after 
GAO's latest operation. While I applaud the NRC's prompt 
response and recognize that this is a step in the right 
direction, I believe that their change does not go far enough. 
Although license reviewers are now required to visit with 
applicants seeking Category 3 licenses, that ``visit'' can be a 
simple meeting at the NRC's offices. So the problem is clear: 
Even with this recent change in procedures, the NRC license 
reviewers are still not required to visit facilities of 
applicants seeking Category 3 sources before issuing a license. 
I believe the NRC should require on-site visits--which Maryland 
apparently requires--not meetings at the NRC--before Category 3 
licenses are issued.
    In addition, the NRC should evaluate whether to include 
Category 3 sources in the proposed National Source Tracking 
System, which will be designed to monitor the most lethal 
sources from cradle to grave.
    The NRC should also take steps to ensure that source 
materials can be obtained only in authorized amounts by 
legitimate users. For instance, the NRC should consider 
establishing a web-based licensing system so that suppliers can 
go online and check first, that a purchaser's license is 
actually valid and second, how much radiological material the 
purchaser is authorized to obtain.
    These recommendations are designed to bolster our 
government's efforts to prevent a radiological attack in the 
United States. It is clear that terrorists are interested in 
using a dirty bomb to wreak havoc in this country. In the words 
of one homeland security expert, the impact of such an attack--
even a relatively simple and small dirty bomb--could be a 
``nightmare scenario.''
    The issue here is not the amount of lives that would be 
lost in the explosion itself, or even the amount of 
radiological material. It is the psychological and the economic 
impact of having radioactive material thrown about perhaps in a 
place like Wall Street or in the halls of Congress, and the 
impact that would have, the longstanding economic and 
psychological impact that would have.
    One critical step is to prevent America's enemies from 
acquiring radioactive materials in the first place. To that 
end, the NRC should focus on ensuring that such materials can 
be obtained only in authorized amounts by legitimate users. 
These measures will help ensure that the ``nightmare scenario'' 
of a dirty bomb never occurs.
    I look forward to hearing the testimony from the GAO and 
Commissioner McGaffigan from the NRC today. I know the 
Commissioner is passionate about the NRC, and I commend his 
long tenure in government service. I look forward to discussing 
with him how we can work together to better protect America.
    Thank you, Mr. Chairman.
    Senator Levin. Thank you, Senator Coleman. Senator Collins.

              OPENING STATEMENT OF SENATOR COLLINS

    Senator Collins. Thank you, Mr. Chairman. Let me start by 
commending you, Mr. Chairman, and Senator Coleman for your work 
on this very important investigation.
    Since the terrorist attacks of September 11, 2001, I have 
had the privilege of working with the Members of this 
Subcommittee, particularly Senator Coleman, on bipartisan 
measures to strengthen security at our borders and at our 
seaports. We have made some real progress in preventing 
terrorists, explosives, biological and chemical weapons, and 
radioactive materials from penetrating our defenses. Those 
gains will avail us little, however, if homegrown terrorists 
can readily acquire deadly materials within our borders to fuel 
their attacks. The enterprising work of the GAO investigators 
suggests that they could do exactly that with relative ease.
    The threat of a ``dirty bomb'' seeded with radioactive 
materials is widely recognized. The former head of Britain's 
intelligence service has said it is ``only a matter of time'' 
before a dirty bomb attack strikes a country in the West. But 
we are not the only people feeling threatened: The Chinese 
Government has included a dirty bomb drill in its security 
planning for the 2008 Olympics. The consequences, as my 
colleagues have indicated, could be dire.
    A 2004 study published by the National Defense University 
concludes that a dirty bomb attack ``is apt to cause mass panic 
and great economic damage,'' even if it is unlikely to cause 
widespread fatalities. A new Canadian Government study 
concludes that exploding even a small dirty bomb in Ottawa 
could cause over $20 billion in economic disruption, in 
addition to localized death and destruction.
    If it is indeed a relatively simple matter to obtain, 
alter, or counterfeit Nuclear Regulatory Commission licenses to 
acquire radioactive materials, then we face yet another 
challenge to achieving homeland security for our people.
    The GAO deserves great credit for giving us concrete 
evidence of this vulnerability, and, again, I want to comment 
Senator Coleman and Senator Levin for pursuing this 
investigation. This morning many of us woke up to the report 
talking about a possible diversion of an airplane. It is a 
useful reminder that indeed everything has changed since 
September 11, and this Subcommittee, I know, will continue its 
work to identify vulnerabilities and propose reforms to 
increase the chances of yet another attack. Thank you, Mr. 
Chairman.
    Senator Levin. Thank you, Senator Collins. Senator Akaka.

               OPENING STATEMENT OF SENATOR AKAKA

    Senator Akaka. Thank you, Mr. Chairman. I want to thank you 
for holding this timely and very important hearing. Despite the 
numerous measures designed to tighten domestic and 
international control over the last several years, high-risk 
radioactive sources are still vulnerable to theft and misuse.
    For the sake of bringing back some history of the work of 
this Subcommittee, I want to go back to the year 2000. I have 
been concerned about this threat for several years now, and as 
Ranking Member of the International Security Subcommittee at 
that time, I expressed my concern that we needed to be better 
prepared to respond to terrorist attacks. And this was in the 
year 2000. This led me in early 2002 to request that the 
Government Accountability Office investigate domestic and 
international control of radioactive sources, including the 
Nuclear Regulatory Commission's licensing and control of 
radioactive sources.
    In an August 2003 report to me, GAO stated that the NRC did 
not know the precise number of sealed sources in use in the 
United States, that NRC had difficulty in accounting for 
generally licensed devices containing sources, and that the 
security of those devices varied at the State level.
    As a result, I introduced legislation in 2003 to safely and 
securely dispose of low-level radioactive waste. This finally 
became law in the Energy Policy Act of 2005. The fact is that 
my legislation should not have been necessary. The NRC and the 
Department of Energy should have solved this problem. But, 
unfortunately, my legislation wasn't enough.
    GAO testified in front of the Permanent Subcommittee on 
Investigations 3 years later that more work needed to be done. 
On March 28, 2006, Gregory Kutz, Managing Director of Forensic 
Audits and Special Investigations at GAO, one of our witnesses 
here today, stated that undercover GAO investigators were able 
to buy radioactive sources using a fake company and were able 
to transport the material into the United States using 
falsified NRC documents modeled after those they found on the 
Internet.
    The results of GAO's most recent sting operation indicate 
that these vulnerabilities in the licensing process still 
exist. Clearly, more work still needs to be done if we are 
going to prevent a dirty bomb attack on U.S. soil. The critical 
first step in that process must be to ensure strong regulatory 
control over the material used to make such a bomb.
    If we are to believe the March 10, 2007, statement of 
captured al-Qaeda operative Khalid Sheikh Mohammad, in which he 
told a U.S. military tribunal that he was, ``directly in charge 
. . . of managing and following up on dirty bomb operations on 
American soil,'' then the risk of a dirty bomb attack by 
terrorists remains very real. We cannot allow the NRC licensing 
system to continue to fail, as it did during the two GAO 
undercover operations.
    In closing, I would like to remind this Subcommittee of 
another al-Qaeda operative, Dhiren Barot, who told a British 
court in May about his plans to attack the United States and 
the United Kingdon using a dirty bomb comprised of, and I am 
quoting, ``a few grams of cobalt-60 with several pounds of 
explosives . . . enough to close off an area the size of 
Manhattan.'' These words are chilling, but they remind us that 
we must remain vigilant.
    Mr. Chairman, I would once again like to thank you and 
Ranking Member Coleman for organizing this hearing, and I look 
forward to discussing what steps we can take to ensure that a 
dirty bomb attack on U.S. soil never happens. Thank you, Mr. 
Chairman.
    Senator Levin. Thank you very much, Senator Akaka, and 
thank you for your longstanding efforts in this area. They have 
made a notable contribution, and much of the work which you 
have just discussed is an important background for the work 
that will be discussed today.
    Senator Carper.

              OPENING STATEMENT OF SENATOR CARPER

    Senator Carper. Thanks, Mr. Chairman. Thanks for bringing 
us together today. Welcome to our witnesses and colleagues.
    The Nuclear Regulatory Commission has a monumental 
responsibility, and I can say with confidence that I believe 
they fulfill that responsibility admirably in most cases.
    When I was Governor of Delaware, I oftentimes said to my 
cabinet--I still say it to my staff here--``If it isn't 
perfect, make it better.''
    When it comes to regulating the nuclear industry--from 
construction gauges to nuclear power plants--the NRC has to be 
perfect, or as close to perfect as they can be.
    As Chair of the Clean Air and Nuclear Safety Subcommittee, 
part of the Environment and Public Works Committee, oversight 
of the NRC is one of my top priorities. It is a priority that I 
share with Senator George Voinovich, who is the Ranking Member 
of that Subcommittee. In that capacity, we have closely 
monitored the NRC's efforts to gear up for a renaissance in new 
nuclear power, and I have often warned the NRC that they cannot 
lose sight of their current responsibilities while preparing to 
deal with the enormous task of licensing a new fleet of nuclear 
power plants.
    When the NRC fails as significantly as they appear to have 
failed in this instance, it shakes the public's confidence. I 
believe safe, reliable, new nuclear power is one of the keys to 
our Nation's energy security and climate change concerns. 
However, a lack of public confidence in the NRC will undermine 
that opportunity before it even begins.
    This incident, coupled with the nuclear fuel spill last 
year, which was inexplicably kept from Congress for over a 
year, cannot be ignored nor simply brushed aside as small 
events that we hope will not happen again, because this is not 
just about public confidence in the Nuclear Regulatory 
Commission and nuclear power. This is about public safety.
    When I think about this episode, what is most distressing 
to me is the fact that we should have known better. Experts 
have been warning us for years now about the impact a dirty 
bomb exploding in an American city could have. There could be 
loss of life, of course, but the long-term impact such an 
incident would have on the economic and physical health of the 
community that was targeted are likely immeasurable.
    The psychological impact a dirty bomb explosion would have 
not only on the community that was hit but on the Nation as a 
whole cannot be discounted either. We can open the paper and 
turn on the news every day and see the impact conventional 
explosives placed in a backpack or in the trunk of a car have 
had in communities like Great Britain, Spain, Israel, and Iraq. 
Just imagine what would happen if those explosives were coupled 
with radiological materials.
    The fact is that a dirty bomb is likely the worst terrorist 
threat we face as a Nation today, and one of our major lines of 
defense against them did not hold up when tested. Luckily, this 
test was not a real test and, hopefully, we can learn from the 
mistakes that were made.
    The sin is not in making mistakes. The sin is not learning 
from those mistakes. A big mistake has been made here, I 
believe. We have got to learn from it. Thank you, Mr. Chairman.
    Senator Levin. Thank you, Senator Carper.
    We now welcome our first panel to the hearing this morning 
from the Government Accountability Office. We have Eugene 
Aloise, Director of the Nuclear and Nonproliferation Issues 
Unit at GAO; Gregory Kutz, the Managing Director of the 
Forensic Audits and Special Investigations Unit at GAO; and 
John Cooney, Assistant Director of the Forensic Audits and 
Special Investigations Unit.
    Gentlemen, we welcome you, in some cases back to the 
Subcommittee. You have testified here many times before, and so 
you are aware that we have a rule under which all witnesses who 
testify before the Subcommittee are required to be sworn, and I 
would ask you at this time to please stand and raise your right 
hands.
    Do you swear that the testimony that you are about to give 
before this Subcommittee will be the truth, the whole truth, 
and nothing but the truth, so help you, God?
    Mr. Aloise. I do.
    Mr. Kutz. I do.
    Mr. Cooney. I do.
    Senator Levin. The timing system that we will use today 
will provide that the yellow light comes on 1 minute before 
your time is up. The light will change from green to yellow, 
which will give you an opportunity to conclude your remarks. 
Your written testimony will be printed in the record in its 
entirety. We would appreciate your limiting your oral testimony 
to no more than 10 minutes.
    Mr. Kutz, I understand that you are going to be presenting 
the GAO's statement this morning. Is that correct?
    Mr. Kutz. Yes.
    Senator Levin. Then you may proceed.

 TESTIMONY OF GREGORY D. KUTZ,\1\ MANAGING DIRECTOR, FORENSIC 
AUDITS AND SPECIAL INVESTIGATIONS; EUGENE E. ALOISE, DIRECTOR, 
    NATURAL RESOURCES AND ENVIRONMENT; AND JOHN W. COONEY, 
ASSISTANT DIRECTOR, FORENSIC AUDITS AND SPECIAL INVESTIGATIONS, 
             U.S. GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Kutz. Mr. Chairman and Members of the Subcommittee, 
thank you for the opportunity to discuss our covert test of the 
NRC licensing process. The bottom line of our testimony is that 
we were able to obtain a genuine NRC license using bogus 
documents. This license could have been used to accumulate 
dangerous amounts of radioactive materials.
---------------------------------------------------------------------------
    \1\ The joint prepared statement of Mr. Kutz, Mr. Aloise, and Mr. 
Cooney appears in the Appendix on page 39.
---------------------------------------------------------------------------
    Our testimony has two parts: First, our prior 
recommendation; and, second, the results of our covert test.
    First, in August 2003, GAO reported vulnerabilities in the 
NRC licensing process. We recommended that NRC strengthen its 
process to ensure that sealed sources could not be purchased by 
those with malicious intent.
    As shown on the posterboard timeline, NRC issued new 
guidance over 3 years after our recommendation. At the request 
of this Subcommittee, we performed covert testing of the 
revised NRC licensing process.
    Moving on to our second point, our test clearly shows that 
the revised NRC process did not work. Using bogus businesses 
and documents, along with a little social engineering, we were 
able to obtain a genuine NRC radioactive materials license. Let 
me walk you through what we did and what we found.
    For this investigation, we incorporated two bogus 
businesses--one in a State where NRC issues licenses, and one 
in an Agreement State. Those attempting to purchase radioactive 
materials----
    Senator Levin. Would you stop there? I hate to interrupt 
you, but what is, for everyone's understanding, an ``Agreement 
State''?
    Mr. Kutz. Those are States that have been delegated 
licensing authority by the NRC to issue radioactive materials 
licenses. So either NRC issues them or Agreement States will 
issue them.
    There are 34 of these Agreement States, and as I mentioned, 
they have been delegated the licensing authority from the NRC. 
One of our tests was of the NRC process, and one of our tests 
was of a State process--as Senator Coleman mentioned, the State 
of Maryland.
    In February 2007, using the two bogus businesses and our 
fictitious owners and officers, we submitted one application to 
the NRC and one to the Agreement State. As with all of our 
undercover operations, we used only publicly available 
information, hardware, and software in making our applications.
    For the NRC application, we received two calls from the NRC 
reviewer asking for additional information. In both instances, 
we amended our application and faxed the additional information 
to the reviewer. As shown on the posterboard, in March 2007, 28 
days after making our application, we received our NRC license.
    As shown on the next posterboard, and as Senator Coleman 
had showed, we altered our genuine NRC license to allow for the 
purchase of unlimited quantities of radioactive materials. We 
then faxed this altered license to two suppliers who committed 
to shipping us numerous machines containing radioactive 
materials. We did not actually buy the machines or radioactive 
materials, primarily due to safety and cost considerations. The 
material that we could have acquired from these two suppliers 
was sufficient to reach the International Atomic Energy 
Agency's definition of Category 3. Category 3 sources are 
considered dangerous if not properly secured. More importantly, 
with patience and money, we could have accumulated 
substantially more radioactive material from other suppliers.
    To NRC's credit, and as shown on the posterboard, after we 
informed them of our operation in early June 2007, they 
suspended their licensing program. Within a matter of days, 
they issued supplemental interim guidance. Although a step in 
the right direction, we continue to believe that this guidance 
should require a site visit before a license is issued.
    For the State application, the reviewer called to inform us 
that a site visit would be required. Since the company office 
and storage facility that we described and showed in our 
application did not exist, we chose at this point to suspend 
our application. We later informed the State that we would not 
be pursuing our license because of financial problems.
    In conclusion, 3 years after reporting NRC process 
vulnerabilities, we were able to beat the system with a basic 
ruse. Recent events in the United Kingdom have reminded us that 
terrorists will use whatever means are available to cause fear 
and economic harm and to kill innocent people. In this 
challenging environment, agencies like the NRC must continue to 
aggressive and proactively assess and address threats. Although 
we are encouraged by NRC's recent actions, closing the 
vulnerabilities discussed today will require additional actions 
and could take years.
    Mr. Chairman, Members of the Subcommittee, this ends our 
statement. Mr. Aloise, Special Agent Cooney, and I look forward 
to your questions.
    Senator Carper [presiding]. Mr. Kutz, thanks very much. I 
am going to ask Senator Coleman, if you would like to lead off 
with questions, and then we will go to Senator Akaka and then 
to Senator Collins, and then I will follow her.
    Senator Coleman. Thank you, Mr. Chairman.
    Senator Carper. You are recognized for 8 minutes.
    Senator Coleman. Mr. Kutz, looking at the timeline there, 
there was apparently a 3-year period from the 2003 report that 
Senator Akaka talked about, which indicated that there were 
concerns raised about the licensing process, and the guidelines 
issued. Do you have any reason why it took 3 years?
    Mr. Kutz. Well, and I would ask other people on the panel 
to add in. I think that they did not take us as seriously the 
first time as they did based on our most recent sting, because 
in the most recent sting they revised their policies within a 
matter of 12 days. The first recommendation, it took over 3 
years. So I believe that they took this sting more seriously.
    Senator Coleman. Was there any technical problem? I am 
still trying to understand, and they are maybe simply not 
taking it seriously, and we will certainly turn to the NRC. Are 
these complex technical issues that had to be reviewed and 
analyzed for a few years before new procedures were put in 
place?
    Mr. Aloise. Senator, if I might?
    Senator Coleman. Mr. Aloise.
    Mr. Aloise. Senator, there is a lot of what NRC does that 
we agree with, and we have a lot of respect for NRC. We have 
our differences, too, and this is one of the areas. In our 
view, NRC has not been aggressive enough in licensing and 
tracking radiological sources, the materials that can be used 
to make dirty bombs. And, in fact, one of their executives told 
us, ``We are not good at deterrence in this area.''
    So we believe they need to be more aggressive in this area. 
We have for several years now. It is evidenced by the fact that 
it took them 3 years to develop guidance which we beat in 28 
days.
    Senator Coleman. Some would suggest, some might argue that 
this issue was being hyped. How would you respond to that?
    Mr. Aloise. We believe it is a very important issue and it 
needs their attention. Let's just fix the system that is 
broken.
    Senator Coleman. Looking at the quantity of materials that 
you were able to counterfeit, how difficult was it to alter the 
license? What kind of procedures did you employ? Is this 
something that would require great technical expertise, or was 
it a simple process they used?
    Mr. Kutz. It was a simple process, basic off-the-shelf 
hardware and software. And, actually, we probably used a more 
elaborate scheme than we needed to because we had to fax the 
license to the suppliers to get the actual shipment. So we 
could have probably just done a basic cut and paste and faxed 
it, but we actually took the license, scanned it in, and 
modified those sections, and then faxed it to two suppliers, 
and it looked genuine at that point.
    Senator Coleman. When you faxed it to two suppliers, did 
Supplier 1 know that you faxed it to Supplier 2?
    Mr. Kutz. I do not believe so.
    Senator Coleman. And if there were Suppliers 3, 4, 5, 6, 7, 
8, 9, and 10, would they have any--is there any system in place 
that would alert any of the other suppliers that, in fact, a 
single license was being used multiple times to obtain 
quantities of material in excess of the license's ``allowable 
amount''?
    Mr. Kutz. Not that we are aware of. As I mentioned in the 
opening statement, I think if we had been patient, taken our 
time, and had a little bit more money, we could have continued 
to purchase machines with radioactive materials.
    Senator Coleman. One of the recommendations in the report 
concerns the ability to counterfeit. You were able to change 
the quantities and material that is involved. You could have 
sent it out to multiple suppliers. I take it, from what we have 
seen in the past, that, for terrorists, getting and having 
money has not been a problem.
    I have talked about a web-based system. Can you respond to 
that recommendation?
    Mr. Kutz. For the counterfeiting issue?
    Senator Coleman. Yes.
    Mr. Kutz. Yes, that would be a better way to address the 
counterfeiting. I think the reason I mentioned in my opening 
statement that a solution may be several years away is I 
believe NRC's documents are showing 2009 as the implementation 
date for a web-based system. So, in the meantime, that 
vulnerability will still exist unless they have other 
alternative means for suppliers to be able to look to determine 
that a license is counterfeit.
    Senator Coleman. And when we say web-based system, that 
would mean that you would have a single database that people 
would go to, that suppliers or others would have to go to the 
single database, and this database could indicate whether, in 
fact, multiple suppliers were being employed and whether the 
license was being used beyond its intended purpose? Is that 
correct?
    Mr. Kutz. Yes, for the counterfeiting, we believe that the 
web-based system would have great potential.
    Senator Coleman. What is the application fee from the NRC 
for this license? And what is the application fee from one of 
the Agreement States, from Maryland?
    Mr. Kutz. For NRC it was $1,200; for Maryland it was 
$1,000.
    Senator Coleman. So the NRC license, the application fee 
was a little more, and yet they didn't require a site visit?
    Mr. Kutz. Right. Maryland was going to actually visit our 
facility, tour the facility, and take 7 months for the process. 
The NRC process, as we mentioned, took 28 days, and so from a 
cost perspective, I would assume Maryland would have cost a 
little bit more to do that work.
    Senator Coleman. I am trying to understand why a site visit 
may not be recommended. In 2007, after the sting, the NRC did 
change the regulations and talked about a visit. Did that visit 
mean a site visit, or it could have meant some other kind of 
visit?
    Mr. Aloise. Are you talking about their new interim 
guidance?
    Senator Coleman. Yes, new guidelines.
    Mr. Aloise. It is an either/or. They are either going to 
have a site visit or they are going to allow for a face-to-face 
visit in an NRC office, which we do not believe is as good as 
actually touring the site.
    Senator Coleman. So, in fact, you had to shut down your 
application when Maryland said they were going to tour the site 
because there was no site.
    Mr. Aloise. There was no site.
    Senator Coleman. Is this a volume issue? Is the NRC so 
overwhelmed with applications that it is difficult or 
impossible for them to actually do site visits?
    Mr. Aloise. There are always resource issues to be 
addressed. The States have to address them, too, but the States 
are able to make the site visits as well.
    Site visits are something that should be explored through 
contracting or however it needs to be done, but it needs to be 
done.
    Mr. Kutz. Well, Senator, I would say, too, with respect to 
the office visit versus the site visit, certainly the office 
visit is an improvement from what we had because Special Agent 
Cooney received two phone calls. So on the phone, it is easier 
to engineer the situation than face to face. I am not 
discounting that an office visit would be tougher, but it is 
possible to beat an office visit.
    Senator Coleman. Senator Carper had a wonderful statement. 
He said, ``If it isn't perfect, make it better.'' Clearly, a 
visit to the office is better than no visit, but a site visit 
to determine whether, in fact, there is a site is obviously 
better than a phone call or calling somebody into the office.
    Mr. Kutz. Yes, we would consider that the gold standard.
    Senator Coleman. And as a result, do you believe that the 
June 2007 interim guidance solved the problem?
    Mr. Kutz. Well, no. Again, I think there are three parts to 
it. I think that the issue of office visit is only one element. 
The other issue you mentioned, counterfeiting, has not been 
solved. I think there is a third element here, the human 
capital element. Part of what we do in testing, oftentimes you 
have good policies on paper, but you are able to beat the 
people. And that is the other part of this, I think, that needs 
to be addressed. I think they have talked about additional 
training from the standpoint of security and how to recognize, 
and even in the guidance they had in 2006, there were certain 
steps that if someone had followed for our test, like done a 
Google, for example, they would have figured out that we do not 
exist.
    Senator Coleman. Let me talk about the amount of material. 
There are some who would argue that these are insignificant 
amounts. In fact, as I recall the Time Magazine report about 
the London terrorists, they were actually taking apart smoke 
detectors to try to create some kind of dirty bomb.
    Can you respond to the notion that we are really dealing 
with insignificant quantities here? And, again, it gets back to 
this issue that we are making this to appear to be a bigger 
problem than it really is.
    Mr. Aloise. Senator, of course, there is a lot of debate 
about this. It is almost like asking how many sticks of 
dynamite it takes to make a car bomb. The point is once an 
explosion occurs, or a dispersal event happens, and first 
responders' radiation detectors go off, the consequences start 
from there. You do not know what it is you are dealing with. 
You do not know how much. You do not know how dangerous the 
isotope is. So you are going to have to take actions like 
evacuating the area, shuting down businesses, closing down 
transportation.
    No one knows what the impact would be. That is why it is so 
important to prevent it.
    Senator Coleman. And there is no question in your mind 
that, with the phony license that you received for a bogus 
company, you would have been able to obtain enough material to 
construct a dirty bomb that, if exploded in a place like Wall 
Street or some other area, would have significant economic 
impact and psychological impact beyond just the loss of life 
that may or may not have occurred?
    Mr. Aloise. We are absolutely convinced.
    Senator Coleman. Thank you, Mr. Chairman.
    Senator Carper. You are welcome.
    Senator Akaka, you are recognized for 8 minutes.
    Senator Akaka. Thank you very much, Mr. Chairman.
    First, I would like to thank GAO for their hard work over 
the years and their hard work for this Subcommittee on this 
issue. And I thank Senator Coleman and Senator Levin for 
keeping this issue in the spotlight.
    After hearing your testimony, Mr. Kutz, that GAO has made 
recommendations and also has reported results of your findings, 
and that you are recommending that NRC licensing be 
strengthened, although still early this year your covert 
process found that it did not work, so, Mr. Kutz, GAO has 
recommended that NRC consider the social and economic impacts 
of radioactive sources using a dirty bomb. Given the difficulty 
in measuring these aspects, my question to you is how NRC might 
do this?
    Mr. Kutz. There are several elements of this. There is the 
site visit that we believe is important, and I know that even 
under their old process, the site visit was going to happen, 
but possibly a year after you actually got your license. We 
still believe a face-to-face site visit would be a good step 
before you issue a license.
    We mentioned the issue of counterfeiting. Even if you do 
the site visit, suppliers who receive a faxed copy of an NRC 
license that is counterfeited still today could possibly end up 
shipping to someone with malicious intent. So the 
counterfeiting issue needs to be dealt with. And as I 
mentioned, the human capital element of this, having people 
trained in whatever guidance exists, assuming the guidance 
becomes solid and good, are people trained in actually looking 
at this from a security standpoint in addition to the 
scientific and technical standpoint? We think that is also 
something that they need to consider from a training 
standpoint.
    Senator Akaka. All right. Well, thank you very much.
    Thank you, Mr. Chairman.
    Senator Carper. Thank you, Senator Akaka.
    Senator Collins, you are recognized for 8 minutes.
    Senator Collins. Thank you very much, Mr. Chairman.
    Mr. Kutz, I was struck with how different the response was 
from the State of Maryland versus the NRC, and if you had asked 
me prior to this investigation which entity would have done a 
more thorough review, I would have guessed without hesitation 
that it would have been the NRC and not the State Government. 
So I think that is a very interesting finding because the 
scrutiny of the two applications was dramatically different to 
the point where GAO abandoned its plans to pursue the license 
from the State of Maryland. There are, however, 33 other 
States, in addition to Maryland, that have agreements with the 
NRC and, thus, the authority to issue licenses.
    Do you have any idea whether the quality of the review 
process in those other States is as stringent as it was in 
Maryland?
    Mr. Kutz. I will let Mr. Aloise add, but I am not aware of 
that. I know that after we did our operation, NRC immediately 
held, I believe, a teleconference with all the States to tell 
them what we did, how we did it, to make sure that they were 
alerted, which was a positive step, we believe. But I would 
expect they are not following the exact same process in all 34 
States.
    Mr. Aloise. Senator, when we did our report in 2003 for 
Senator Akaka, we did not survey all the States, but we did 
come across a number of States that also made site visits. 
South Carolina and Georgia come to mind. And State officials 
told us that they thought a lot of other States were making 
site visits.
    Senator Collins. I just wonder--and I am very glad to hear 
the NRC shared the results of the recommendations.
    The Nuclear Regulatory Commission I would have expected to 
have the most stringent of all procedures, but I would suspect 
that smaller States with fewer resources--a State like mine, 
for example, which has tight budget constraints and perhaps 
limited expertise in this area--might not have the kind of 
intensive scrutiny that a larger State would have.
    Could you tell me more about how the Regulatory Commission 
licenses States or enters into this agreement? Could you tell 
me more about the process for allowing States to undertake 
their own licensing?
    Mr. Aloise. They basically have to meet NRC's requirements 
for taking over the licensing process, and then NRC reviews 
them periodically to make sure they are still operating the way 
they agreed to operate.
    But, in some cases there may not be all that many licensees 
involved. It depends on the type of material. In some cases, 
there are 55 licensees for a specific amount and type of 
material, and in other cases there are more. It depends on the 
State, and, you are correct, State resources.
    But, again, when we met with the State organizations, most 
of them thought that they were--or a lot of them were--doing 
site visits. They believe it is that important.
    Senator Collins. Are the majority of licenses issued by the 
34 States or by the NRC?
    Mr. Aloise. The 34 Agreement States have about 80 percent 
of the licensees. NRC has about 20 percent of the licensees.
    Senator Collins. That is what my understanding was. That 
suggests to me that we should also take a look at how the 
States implement this. If the vast majority of licenses are 
being issued at the State level, perhaps we should do some sort 
of assessment or ask the NRC to do some sort of assessment 
testing the quality of the State regulatory schemes.
    The second issue I want to raise with you, Mr. Kutz, is how 
you went about counterfeiting the license that you received 
from the NRC. Did this take any special expertise? Were you 
able to use off-the-shelf software, or did you have special 
expertise that the average person would not have access to?
    Mr. Kutz. One of the basic rules when we do these kind of 
operations is to only use publicly available information, 
hardware, and software. So what we did, we bought from public 
sources that anyone could buy from, whether it be the paper or 
the actual machines that we used.
    Senator Collins. That was a point that I wanted to 
emphasize because you were able to do this, it seems to me, 
very easily, so it does not take access to specialized 
equipment or esoteric software or a lot of expertise to 
undertake the kind of counterfeiting that you were able to 
accomplish. Is that correct?
    Mr. Kutz. Yes. Well, not only that, we probably were much 
more sophisticated than we needed to be because at the end of 
the day all we had to do was fax this to a supplier. And, a fax 
copy is not as good as an original, so I think a cut and paste 
would have potentially even worked because over a fax you are 
not going to know the difference.
    Senator Collins. That is true. Yes, Mr. Cooney?
    Mr. Cooney. I would like to add that this particular 
license is really very easy to counterfeit. As you know, you 
can counterfeit anything. However, the NRC license in 
particular has really no security features in it. It has no 
watermarks. It has no microprinting. It has no holograms. So it 
begs the question to be asked even if there are any real 
counterfeits out there that we do not know about because it was 
such an easy item to reproduce.
    Senator Collins. And that raises an important question as 
well of whether the Commission ought to be reviewing licenses 
that have been issued and do some sort of security check, given 
how easily you were able to counterfeit it.
    Is there a role here to be played by the suppliers? You 
talked about that you faxed the counterfeit license to two 
suppliers, and the amount that you were able to order far 
exceeded the amount that you were licensed for. Is there a role 
for suppliers in reporting back to the Commission when there is 
a purchase? Is there any feedback loop that might allow the 
counterfeiting to be identified through the supplier providing 
information to the Commission?
    Mr. Kutz. Yes. I would mention on the other one that NRC 
has said they are going to do a lookback to see if there are 
counterfeit licenses. Back to your prior point, I believe they 
are going to take a shot at looking back to see if something 
has happened in the past.
    With respect to suppliers, the interesting thing about the 
suppliers is that what they cared about the most from us was 
doing a credit check and whether we could actually pay for what 
we wanted to buy. They were not as concerned--I mean, they 
assumed that since we had this license that it was genuine, and 
so they did not have any means to determine that it was not. So 
the web-based system that has been discussed would seem to me 
to be one of the solutions for the counterfeiting because 
again--and we found this, again, in all the operations we do 
when we are dealing with things like this. Entities like this, 
and I think Mr. Cooney can explain to you how disappointed they 
were when they found out that ours was not a legitimate order. 
This was big to some of these small businesses, so they were 
most interested in getting the business. The security feature 
was not that important to them.
    Senator Collins. Thank you. Thank you, Mr. Chairman.
    Senator Carper. You bet.
    Gentlemen, thanks very much for your testimony and for your 
work. I was sitting here just thinking that I am glad GAO is on 
our side. We appreciate your efforts in this matter.
    Senator Coleman. Mr. Chairman, could I ask one follow-up 
question?
    Senator Carper. Certainly.
    Senator Coleman. Were you going to dismiss the panel?
    Senator Carper. No. I am going to ask some questions.
    Senator Coleman. OK. I thought you said you were done.
    Senator Carper. Oh, no. Just warming up. [Laughter.]
    I want to go back to the last point that Senator Collins 
was making. The suppliers, the potential suppliers, the willing 
suppliers here, they are in this to make money like most 
businesses. Their primary responsibility certainly is not to 
safeguard these materials and to make sure that they are secure 
and do not fall into the wrong hands.
    I do not know if you have talked to the suppliers 
themselves. Do they feel any compunction at all with respect 
to--or any concern at all about these materials falling into 
the wrong hands? Or do they just figure show me the license, we 
believe you are good to go, send me your money, we will check 
your credit, and it is a done deal? What is their approach? 
What is their mind-set? Mr. Aloise.
    Mr. Aloise. Well, that certainly describes the two we are 
talking about--we just dealt with the two in this test. I think 
Mr. Cooney can elaborate. They were interested in the size of 
the business and getting our money.
    Mr. Cooney. They were disappointed that they did not get 
our business, of course. However, when we spoke to them 
afterwards, they stated that they followed all their procedures 
that they were mandated by, and they----
    Senator Carper. Mandated by whom?
    Mr. Cooney. By their own internal protocols. But they felt 
that the NRC should guarantee in some way the license presented 
to them. They are looking at NRC to say that the license is 
good. It should not be on them, the business, in their defense, 
to have to determine that the person is legitimate if he 
possesses and presents them with an NRC license. They are 
assuming that the license is OK, and they are assuming that NRC 
has granted it under legitimate means.
    Senator Carper. I would say to my colleagues, that reminds 
me a little bit of the immigration debate with respect to 
employers, knowingly or unknowingly, hiring illegal aliens.
    Just a word or two, your thoughts with respect to the 
adequacy of their internal procedures for the suppliers. Any 
thoughts?
    Mr. Kutz. Well, again, from a security standpoint, I think 
there is more that needs to be done. They were not really going 
to challenge anything. We could have done a much less elaborate 
process, taken a license off of the web page, the web 
basically, just counterfeited it and faxed it to them and 
potentially gotten the materials. So they really did not have a 
mechanism in place at this point. That is why, again, I think 
this web system has potential for a place where they can go 
from a secure perspective to determine whether the people they 
are dealing with are genuine and that the amounts that we are 
asking for are within the guidelines of the license that we 
have.
    Senator Carper. Mr. Cooney, you mentioned that the 
suppliers were disappointed not to be able to make the sale. 
Were they willing to offer quantity discounts to GAO?
    Mr. Cooney. Yes, and in their quotes they gave us quite a 
discount based on volume.
    Senator Carper. All right. Thank you.
    Mr. Kutz. They actually offered us twice as many machines 
as we requested, so when we requested the first set of 
machines, we actually got a quote back for twice as many 
machines as we had actually requested.
    Senator Carper. I would just say to my colleagues as an 
aside, I have been over in Iraq and Kuwait looking into 
contracting, some of the military contracting that goes on, a 
lot of them no-bid contracts, and we are paying a lot more 
money for stuff than we ought to be. We ought to put these guys 
to work on this and get them out there to get us some better 
deals on the legitimate contracting side for the Department of 
Defense. I say that with tongue in cheek not entirely.
    Mr. Aloise, the GAO identified a vulnerability that could 
be exploited to obtain nuclear materials, but just to be clear, 
are there any sort of guidelines used by the NRC that govern 
the amounts of material that could be used in dirty bombs as 
opposed to guidelines that deal with health and security? Let 
me just start with that, and then I will follow up.
    Mr. Aloise. NRC probably could answer that better than I 
could. But I do know that they analyzed the amount we had, for 
example, to determine the potential consequences of the amount 
of material we could have gotten. They are very capable of 
doing that.
    But, again, our point is that the point of a dirty bomb is 
not its scientific aspects, or the amount of material that is 
being used, but the socioeconomic effects of the dirty bomb.
    Senator Carper. All right. And to follow up, I believe NRC 
has focused on Category 1 and 2 quantities, larger quantities. 
How do these quantities differ from the quantities of material 
that GAO was aiming to obtain or could have obtained?
    Mr. Aloise. Well, Category 1 and 2 materials require more 
stringent controls. They are more dangerous so obviously they 
have more controls. However, we think, if we had pursued this 
further, we probably could have got up to Category 2 levels.
    Senator Carper. Do I understand that Category 4 is the 
lowest, the least----
    Mr. Aloise. Category 5 is the lowest.
    Senator Carper. OK. And you were lining up to obtain--get 
somewhere at a low level Category 3?
    Mr. Aloise. I think we reached the bottom of Category 3.
    Senator Carper. Thanks very much.
    Mr. Aloise. I might add, Senator, we have surveyed other 
countries and how they track materials. We surveyed 20 
countries in another report. Fourteen of those countries track 
at least Category 1 through 3 quantities of materials. NRC is 
right now concentrating on Category 1 and 2. And nine of those 
countries track all the way down to Category 5. So other 
countries take this seriously as well.
    Senator Carper. Good. Well, I suspect we will, too, in the 
future thanks to your work.
    Let me talk with you for a moment about stolen materials. 
We are discussing here today the prospect of a real company, a 
supplier, a legitimate company, being willing to make a sale in 
this case to a sham operation that you guys started because you 
presented what appears to be a legitimate license and request 
for that material. What do we know about the safeguards that 
are in place to prevent materials from being stolen that might 
be stolen from a legitimate business. They could be from 
someone maybe who works for that legitimate business or simply 
just stolen from a business from the outside. Can you help me 
on that?
    Mr. Aloise. Of these devices we are talking about, I think 
our report in 2003 said that over a 5-year period there were 
about 1,300 of these devices stolen in the United States. About 
250 a year were stolen, lost, or abandoned. NRC reports that 
most of those were reclaimed. A lot of these are left at a 
construction site. Those kinds of things occur. But they 
usually take prompt action, and once they are notified of that 
and try to get it back.
    Senator Carper. All right. I have a couple more questions, 
but before I ask those, let me just yield back to Senator 
Coleman. Or, Senator Collins before she walks out of the room, 
do you have any other questions you would like to ask of this 
panel?
    Senator Collins. I do not. Thank you.
    Senator Carper. OK. Senator Coleman.
    Senator Coleman. Just actually a quick follow-up to Mr. 
Cooney. The difference between the interview--the site visit 
versus an office interview. I know my staff has been talking to 
the NRC about this, and I think they would say that--first of 
all, they are Ph.D. reviewers who review these applications, 
and I think they may say that those reviewers would ``eat a 
phony applicant's lunch'' in an interview, that they would be 
able to spot them in the interview. Do you think an interview 
with an NRC regional office would have exposed you or blown 
your cover?
    Mr. Cooney. Senator, I am quite confident, having dealt 
with the gentleman I dealt with in the review process, that had 
I met him on a one-to-one basis I could have got through the 
process fine. Early on in our discussions, I determined that he 
was more interested and focused on the process of how to fill 
out the application rather than to determine the legitimacy of 
my use for the application. So I believe with the training that 
I had online, taking the RSO course, and my learned experience 
on the machines that we received through the Internet, that I 
would have been able to successfully get through that 
interview. And also, as you know, Senator, last year on the 
other case we did coming across the border, we were also face 
to face with law enforcement people, and we got through there 
also.
    Senator Coleman. And in that case, the good news is they 
found the materials; the bad news is that after they found it, 
with phony documents you were able to get it through.
    Mr. Cooney. Correct.
    Senator Coleman. And so, Mr. Kutz, I go back then to the 
difference between an office visit versus a site visit. You are 
of the opinion that a site visit would be a much more effective 
way to discover whether something is bogus or not?
    Mr. Kutz. It would be the most effective way, yes.
    Senator Coleman. Absolutely. Thank you. Thank you, Mr. 
Chairman.
    Senator Carper. You bet.
    Gentlemen, let me ask you a couple more questions and then 
we will excuse you and bring on our second panel. I would like 
to have us discuss NRC's responsiveness to your investigation, 
to your sting operation. I find it troubling that ICE 
apparently cited concerns in, I think--was it 2003? And it took 
NRC some 3 years to improve their licensing process. After they 
had done that, it took you all about a month or less to, I 
guess, thwart the newly improved process.
    In your mind, was it legitimate for NRC first of all to 
take 3 years to respond to your initial concerns? And how long 
should it take the NRC to respond fully to the concerns that 
you have raised, I guess to the lessons learned and the 
recommendations that you have made? How long is long enough?
    Mr. Kutz. Well, I will respond first. With respect to what 
it appears, the first step was a good step requiring a site 
visit or an office visit. What they have done on the training 
front we do not know. But the one that looks like it is going 
to take the longest is the web-based system, which they now say 
is 2009. And whether there will even be an implementation 
period over several years, that could even be further than 
that, so added years.
    Senator Carper. How would that web-based system work?
    Mr. Kutz. Well, one element of it could be related to the 
suppliers you talked about. The suppliers could get a secure 
way to get into that system to determine within a matter of 
minutes whether someone ordering materials from them has a 
genuine NRC license and whether or not they are authorized to 
purchase the type of materials that they are submitting an 
order for. That has potential to deal with the counterfeiting 
issue. But that is several years away.
    Senator Carper. I do not pretend to be an expert about 
these things, although I did spend last night in a Holiday Inn 
Express. [Laughter.]
    Not really. I spent last night at home in Wilmington.
    Two years seems like a long time to put up a system like 
that to a lay person. Your thoughts? You guys maybe know more 
about this stuff than I do. You probably do.
    Mr. Aloise. Senator, again, we made this recommendation in 
2003. We are not clear on why it took 3 years to address it, 
and then address it with procedures that we were, as you point 
out, able to beat in 28 days.
    I know NRC will argue with this, but in our view, they do 
not take the threat of these materials as seriously as we and 
others do. It is not that they discount the threat. I am not 
saying that. But if they took it as seriously as we did, they 
would have closed this gap in less than in 3 years.
    Senator Carper. All right. I think I am going to stop 
there, and let me just conclude. Senator Coleman, my 
understanding is that this is an issue you had more than a 
little bit of interest in over the years, and I commend you for 
that.
    I especially want to commend our folks at GAO for the work 
that you have done in this regard, and I look forward to our 
next panel to hear from the NRC to hear their side of the story 
and what they have been doing in response to your 
recommendations.
    I would just close this first panel by observing that this 
is a different world than we live in today, different from the 
kind of world that we grew up in and even the kind of world 
that we had when I was Governor of Delaware and about to come 
here to the U.S. Senate in 2001. Like it or not, our world has 
changed, and the nature of the threats we face has changed as 
well. We have to be more vigilant when we make mistakes like we 
have here, and those mistakes have been identified, and we have 
got to act promptly, with dispatch, to address them.
    Thank you for your work in this regard, gentlemen, and we 
look forward to continuing to work with you in the years ahead, 
and we also look forward to our next panel. Thanks so much.
    Commissioner McGaffigan, I am going to ask you to rise and 
take an oath, please. Do you swear that the testimony you will 
be giving before this Subcommittee will be the truth, the whole 
truth, and nothing but the truth, so help you, God?
    Mr. McGaffigan. I do.
    Senator Carper. Thank you. Please be seated.
    Commissioner McGaffigan, it is always good to see you. 
Today I am glad you are here, but I wish you did not have to be 
here. I wish, frankly, none of us had to be here. But since 
this issue is before us and I know this is an area that you 
have a lot of interest in and a lot of background, we are 
pleased that you could be here to respond on behalf of the NRC.
    You will be recognized for 10 minutes, and I would ask you 
to begin your statement. Once that is completed, we will 
probably be calling on Senator Coleman for questions and then 
Senator Akaka.
    Thank you. Please begin.

  TESTIMONY OF EDWARD MCGAFFIGAN, JR.,\1\ COMMISSIONER, U.S. 
                 NUCLEAR REGULATORY COMMISSION

    Mr. McGaffigan. Thank you, Senator Carper, Senator Coleman. 
I am not going to go through my full statement because I want 
to save some time to talk about some of the issues that have 
been raised.
---------------------------------------------------------------------------
    \1\ The prepared statement of Mr. McGaffigan with attachments 
appears in the Appendix on page 50.
---------------------------------------------------------------------------
    The early part of my statement, my background section, was 
intended to convey what we believe we have done since 2001 to 
deal with the dirty bomb issue. We feel that we have been a 
world leader on almost all of these things. The Code of Conduct 
renegotiation that occurred in 2003 was heavily influenced by 
an NRC DOE report. We got the right radionuclides and we got 
them in the right quantities in defining Categories 1 and 2 in 
the Code of Conduct.
    We did not wait 3 years, as one of the slides will show, to 
implement the 2003 GAO recommendation for high-risk sources in 
Categories 1 and 2. We did that starting in 2003, I believe, 
with the large panoramic irradiators and continuing in 2004 
with manufacturers and distributors and then broadening it 
further in 2005. So for high-risk sources, this sting would not 
work. For high-risk sources, if you are trying to buy a gamma 
knife for a hospital, if you are trying to start a large 
panoramic irradiator to sterilize medical equipment or food, a 
sham company would be caught instantly. And a sham company 
would have been caught instantly a long time ago. We give those 
applicants very tight scrutiny.
    GAO did find a flaw in our system, and we, as soon as we 
understood it, dealt with it. NRC has the interim guidance that 
the GAO witnesses have described, and they believe that 
guidance solves most of the problem, and I can talk about the 
mandatory site visit perhaps in questions or later.
    We appreciate GAO telling us about this vulnerability in 
late May and early June of this year, and almost immediately we 
took some initiatives, and within 2 weeks we had interim 
guidance that we really think solves the problem in the short 
term. We have longer-term solutions like this web-based 
licensing that we are aiming to do, and going to Category 3 
sources is something that we are studying. I personally favor 
it, but to do rulemaking in this country, we have to follow the 
Administrative Procedures Act, and we have to have data. And we 
are gathering that data.
    I suggested last year in one of my votes that we not just 
go to Category 3 sources but we go to one-tenth of the lower 
end of the Category 3 threshold, which would be a factor of 10 
above the top threshold of Category 4. And only if I go to 
that, to one-tenth of Category 3, would I have caught this 
particular sting by GAO.
    So we are serious about this stuff. Most people in the 
world regard us as a world leader. I cannot imagine any country 
having the resources that the GAO witness just suggested to 
follow Category 5 sources. The number of exit signs in America, 
the number of home smoke detectors in America do not lend 
themselves to that degree of scrutiny. So these countries have 
to have exempt levels, and they have to have levels where they 
provide minimal attention, or else they are literally following 
hundreds of millions of devices.
    The NRC, as I said, took this seriously. We have a game 
plan to go forward. We intend to expand our scrutiny of source 
security issues to lower-risk souorces, but we clearly in the 
past few years have had to work on first things first. We have 
to work on the gamma knives and the large panoramic irradiators 
and other high-risk uses of these materials.
    I would say that one of the points made--and we are guilty 
ourselves in this point. One of the points made by GAO in their 
2003 report was that there are hundreds of sources lost every 
year. Dealing with Americium, for example, the threshold in the 
NRC quarterly report for determining whether a lost source must 
ve reported in 30 days is ten-billionth of a curie. The 
threshold for reporting a lost source immediately is one-
millionth of a curie, the amount in a smoke detector. These are 
quantities that are not relevant to dirty bombs, and the 
Commission has very recently directed the staff in the future 
to use Code of Conduct category levels to report these sorts of 
events. The fact is that in the last 11 years that I have been 
with the Commission, the only high-risk sources that have ever 
been lost and not recovered are devices used in oil and gas 
exploration using iridium-192, a radionuclide that has a 
relatively short half-life of 74 days.
    The number of those sources lost and not recovered is in 
the handful in the 11 years I have been at NRC, and because 
they have such short half-lives, you just wait a while and they 
decay away. Sometimes they are lost in the Gulf of Mexico. 
Sometimes they are lost in deep waters. And they are very hard 
to recover. So we do not lose significant sources and not 
recover them. Even small sources such as moisture density 
gauges--when they are lost, we or the State do everything we 
can to recover them rapidly because somebody could, if they 
unshield the material, get themselves a significant dose, and 
we do not want that to happen.
    One other point I want to make. We talk about dirty bombs 
as being ``weapons of mass disruption.'' I personally think 
that we contribute to that, that this psychological fear that 
we have is a combination of threat inflation on the part of the 
terrorists' capabilities, combined with lack of knowledge of 
real radiation effects, and I can go into that in the 
questioning. But we should not aid and abet terrorists by 
fearing things that are the equivalent of working in the 
Capitol or in the Library of Congress where you can get 100 
millirems a year, or the radon in your home, if you have not 
ameliorated it, can give you 400 or 500 millirems a year, or 
getting a CT scan of your chest and abdomen, which might give 
you 2,000 millirems in one dose. The American people I do not 
think are that fragile. Franklin Roosevelt said, ``The only 
thing we have to fear is fear itself.'' We have to do a better 
job of having a dialogue with the American people about which 
of these threats is severe and which are not. And in this 
instance, I honestly think that we have people who hype 
threats. On one of the TV news shows last night, there was a 
fellow who is always hyping threats who wants to clean up 
things to one-millionth of background radiation.
    That would not be sane public policy. If we can have a 
dialogue, it should be about the Department of Homeland 
Security's guidelines. The Department of Homeland Security has 
put out protective action guidelines for what happens after a 
dirty bomb attack. Those guidelines were strongly supported by 
the States. They are strongly supported by us at the NRC. They 
are supported by EPA. They are derivative of EPA guidelines.
    If we can follow those guidelines during an RDD event, 
there will not be the sort of panic that everybody assumes. We 
have done one exercise. In 2002, TOPOFF II, a very senior 
exercise of the U.S. Government, looked at a very large dirty 
bomb, factors of 1,000 or 10,000 larger than the material GAO 
was able to potentially procure. And the mayor of Seattle, 
where this bomb was assumed to go off, was given a choice of 
following the then-EPA, the now-DHS Protective Action Guides, 
or letting his city be paralyzed potentially for years to try 
to get to perfection cleaning it up to one-tenth of the dose in 
the Capitol, in the entire city. He chose to put his city back 
to work. He chose to restrict the very small area that had been 
contaminated to a large degree and where it really was unsafe 
to be there, people would get more than a CT scan of their 
chest and abdomen if they were there all year. And that is the 
EPA PAG.
    I know my time is expired, and I hope I have said a few 
provocative things. But we have to have a better national 
dialogue about dirty bombs than we have had thus far.
    Senator Carper. Commissioner McGaffigan, thank you for 
contributing to that dialogue this morning with your statement 
and for your willingness to be here.
    I need to slip out and go meet with Senator Voinovich, 
ironically, and so I am going to turn the gavel over to Senator 
Akaka. But before I do, I will just repeat something I have 
said to you and to the other members of the Nuclear Regulatory 
Commission before. Everything that I do, I know I can do 
better. And I always say to my staff, ``Everything that we do, 
we can do better.'' I said that as Senator and as governor and 
any other roles I have played. The same is true with the NRC, 
as you know, and to the extent that we have identified some 
weaknesses here, things that need to be corrected, we expect 
you to address them. We realize there has to be some priority. 
Those that are most acute we need to address most readily. 
Those that are least critical we can address later. But to the 
extent that we in the Congress can be of support to you, and 
particularly Senator Voinovich and myself--I think I can speak 
for him as well--you need to let us know because we want to 
make sure these concerns are addressed.
    Mr. McGaffigan. Sir, as you know, that has been my 
philosophy since I came to NRC. We have constantly improved and 
we have not reached perfection. We are going to make things 
better, whether it is in our oversight process for reactors or 
any part of our business.
    I would tell you that the greatest challenge we face with 
these information technology systems such as web-based 
licensing is getting the right people to work for us. It is 
almost impossible on government salaries to get the people that 
really are information technology experts. We are the best 
agency in government in many respects. We have been voted that.
    Senator Carper. I know.
    Mr. McGaffigan. But we are one of the worst agencies in 
government at buying information technology.
    I do not have a solution to that. We go out and we try to 
attract people at the senior level service level, which is what 
I get paid, and we have trouble. We are obviously not unique. 
The FBI, the Pentagon, the FAA, and others have had enormous 
difficulty in this area. But we try very hard to attract the 
right people. The government hiring system--they can get paid 
so much more in the private sector if they are really good. We 
someday have to have more flexibility in the government system 
than we have today.
    Senator Carper. All right. Thank you for that comment, and 
with that I am going to recognize Senator Coleman for questions 
and pass the gavel over to Senator Akaka. Thank you so much.
    Senator Coleman. Thank you, Mr. Chairman.
    Mr. McGaffigan, let me just start by identifying three 
areas where I am in agreement, and I think it is important to 
stress your first comment about tracking Category 5 and the 
difficulty, just some practical limitations we have here.
    The Subcommittee staff report, which focuses on Category 3, 
says the NRC should consider including Category 3, and we use 
the word ``consider'' very carefully rather than ``require.'' 
We want you to look at that. That needs to be looked at. The 
fact that 14 other countries apparently do that I think carries 
some weight. We recognize that certainly at Category 4 and 
Category 5 it may not be cost-effective. But as you look at 
Category 3, that is the issue here, and so ``consider'' is the 
word, and we hope they have fully considered that.
    Mr. McGaffigan. Sir, we will. Category 3 sources are 
dangerous, as I have said in my votes on these issues over the 
years. And I would like to expand, but you have the 
Administrative Procedures Act that I am sure this Committee 
decades ago put into law, and we have to have the data to prove 
that benefits exceed costs to start that rulemaking.
    I believe we will get that data, and as I say, I personally 
would go to one-tenth of Category 3 in terms of the licensing 
so that we would have greater defense in depth in that area.
    Senator Coleman. The other area of agreement I want to 
mention in is the concern over getting technical folks, IT 
folks, to change systems. I had a conversation yesterday with 
the Commissioner of the IRS. Why can't we, for 501(c)(3)s, 
which has been taking up to 6 months to look at an application, 
why don't we have a web-based system to deal with that? And the 
answer was just what you said: It is difficult to get folks who 
are top-notch in IT to do this kind of work, and as a result, 
they are looking to 2009.
    That does not make me very happy. It does not make me very 
happy at all, and I think we have to accelerate this. But I do 
want you to know that I recognize the limitations that we are 
facing, and it is very frustrating.
    Mr. McGaffigan. It is one of the great weaknesses in our 
system. Why doesn't DOD have a better system for getting 
security clearances through? Why doesn't the FBI have better 
ability to share data among analysts? Dealing with information 
technology, everybody talks about off-the-shelf technology. 
There is nothing off-the-shelf because it has to fit within the 
systems that the agencies already have, and it is just very 
hard. The Federal Information Security Management Act is a very 
good act. It probably came out of this Committee. But it is 
very hard to get contractors who fully understand how to do 
that.
    In the National Source Tracking System, we are working with 
Lockheed Martin, and you would think that they could do the job 
and do it well. We are having problems.
    Senator Coleman. Again, there is a lot of frustration, and 
we need to accelerate the pace at which we get this done.
    Let me raise a third issue, which is kind of the 
overarching issue, and that is the danger of a dirty bomb. And 
I agree with you that we have to do a better job of a dialogue 
with the American people. The concern about a dirty bomb, as 
you are well aware, is not the death toll from the explosion 
itself. It is not even the amount of radiation sickness that 
would occur. It is the psychological and economic impact of 
radiological material being spread around a public place and 
the toll that would take. And so I do not think we are in 
disagreement over that.
    The concern that I have here and that this investigation 
reflected is that there is the ability to at least move into 
Category 3, and I do not think we have a chart. I am looking at 
NRC Licensing of Sealed Radioactive Sources, your document.
    Mr. McGaffigan. Yes.
    Senator Coleman. The IAEA Code of Conduct that identifies 
Categories 1 through 5 for both-what is it, Americium? Is that 
how you pronounce that?
    Mr. McGaffigan. Americium.
    Senator Coleman. Americium, and then Cesium-137. But what 
troubles me, what concerns me is that Category 2, Americium, is 
16 to 160 curies, and Category 3 is 1.6 to 16 curies. In other 
words, there is a thin line between the top end of Category 3 
and the bottom end of Category 2. But there is a bright line in 
the procedures that the NRC employs in reviewing Category 2 
versus Category 3 and tracking Category 2 versus Category 3, 
and deciding to issue a license to Category 2 versus Category 
3.
    Do you find that troubling?
    Mr. McGaffigan. I do not think the line is as bright in 
practice. The particular license that GAO was attempting to 
obtain was for the lower end of Category 4 of Americium. The 
lower end of Category 4 is 16 millicuries. They were attempting 
to obtain a license for 200 millicuries. They were attempting 
to do so in a State--West Virginia--where there is a very 
active industry that needs to make sure that when concrete and 
asphalt are laid that there are not holes in them. I am not 
trying to apologize for our licensing officer. We should have 
done better. But it probably sounded like a new small business 
trying to get into business.
    What I am actually more concerned about is the other two 
suppliers. There is a very limited number of suppliers of these 
moisture density gauges, and asking for 45 at once for a new 
business you have never heard of before, there should have been 
some bells going off. It should not have been, ``Oh, my gosh, I 
am going to make a quarter of a million dollars on this sale,'' 
which is probably about what they were quoted. I do not know 
the exact quote. Maybe my GAO colleagues could tell you. 
Instead of getting excited about, ``Oh, my God, somebody is 
buying a quarter million dollars in gauges. It must be the 
biggest firm in West Virginia that somehow just landed on the 
Earth,'' they might have asked a question or two. They might 
have called back to us, and we are going to reinforce, I 
believe, the guidance to those folks and the manufacturers and 
distributors that we want to know about such transactions, 
please call us.
    But, yes, we have to have greater defense in depth in our 
system, and I would add to the points that are in my testimony 
that we are going to have to do a better job with these 
manufacturers and distributors to make sure that they are not 
putting the dollar ahead of the American people.
    Senator Coleman. One of the concerns, the highlight of the 
investigation, is, ``Does the right hand know what the left 
hand is doing?'' So in this case, you have suppliers who saw a 
profit with no requirement to authenticate licenses where the 
web-based system would. What can you do in the short term to 
ensure that if, in fact, there were a terrorist group that was 
well funded that looked at the system and said, ``Hey, right 
now, at least before any changes, we could go to a multiple 
source of suppliers.'' By the way, not just in West Virginia. 
Could they have gone to other States?
    Mr. McGaffigan. The company was an alleged West Virginia 
company. The suppliers are limited. There are not a lot of 
people who try to make money off--there are essentially two, 
right?--two companies that they sought bids from. There are not 
a lot of other companies in this business.
    I do have some trouble with the notion that they could have 
accumulated 450 of these gauges. If that supplier is so profit-
motivated that they would sell 450 moisture density gauges, 
which is probably about as many as could possibly be used in 
West Virginia, Virginia, and North Carolina in this business, I 
think--I would hope that they might give us a call. But we will 
enforce that. We will reinforce that through messages to these 
people in the future.
    Senator Coleman. Because the concern is not limited to just 
one source. The GAO folks are figuring that it is pretty easy 
to get a license here. In fact, they think they could have just 
created one by just going on the web. And then you are going to 
fax it, so now if you could do it for this item, you could 
probably do it for another item or another item.
    Mr. McGaffigan. There are a limited number of items in 
Categories 3 and 4 that we have to be careful about. We are 
going to look at that.
    Senator Coleman. That is what I am looking for. In other 
words, even pre-web-based systems, I would hope that what we 
would see would be a lookback with suppliers and others so that 
you cannot simply counterfeit a license, change the quantity of 
material you are authorized to buy, and then go to various 
sources to get that, to give you then the capacity to do 
something that could be devastating if used by bad people in a 
bad way.
    Mr. McGaffigan. We have been looking since February--and I 
should have, before coming here today, gotten updated as to 
what data we have, probably not full at this point. But we have 
been looking at these devices that are a factor of 10 below the 
Category 3 lower threshold, a factor of 10 above the Category 4 
upper threshold. And we need to just understand how these 
radionuclides of concern are used in real devices in those 
categories and how much of a burden it is going to be to deal 
with. I suspect the burden is not going to be large, and we 
probably already have interim data, and I would be happy to 
share that with you once we fully understand it.
    I do also want you to understand that getting this material 
does not get you an effective dirty bomb. We design these 
moisture density gauges so that the Americium inside is 
encapsulated in two different layers so that people cannot get 
at it easily, cannot hurt themselves. GAO would have had to 
taken the material out of those 45 devices, gotten through 
those two layers. They would best do that with at least some 
sort of glove box where they are protecting themselves, or else 
they will kill themselves. And then they would have to figure 
out how to disperse it optimally.
    From what I have seen of al-Qaeda thus far--there was a lot 
of reference to this 2004 paper. That 2004 paper is 
scientifically inept, to be honest with you, and I hope al-
Qaeda is still there. It may not be. And we do not assume they 
are inept. But it does go to this issue of--there are several 
steps they have to go through to get to a dirty bomb, and then 
the effectiveness of that dirty bomb is something I would be 
happy to talk about.
    Senator Coleman. I have some other questions. What I will 
do, since I am over my time, Mr. Chairman, I will end this line 
of questioning and, Senator Akaka, I would like another 
opportunity then if we could just have a second round. I have 
some follow-up questions.
    Senator Akaka [presiding]. Fine. Thank you very much, 
Senator Coleman. We will have another round after this.
    Commissioner, you mentioned something about staffing, and I 
would like to ask about NRC staffing and, in particular, the 
types of people you hire. We have heard from GAO that NRC 
license reviewers could easily be fooled by a sham company even 
in person. Do you believe it is time to hire NRC staff with 
other skills that enable them to assess the less tangible 
aspects of a license request?
    Mr. McGaffigan. Sir, I believe we have one of the most 
competent staffs in any agency in the Federal Government. You 
have a staffer who once worked for us, and we have had very 
high hopes for her. We are the training ground for a lot of 
other agencies, and we have been named the best agency in 
government.
    Because we have such a challenging mission, we tend to 
attract some of the best and brightest in our population. The 
numbers of PhDs and master's degree holders in our staff would 
match any other agency in the government. So it is not a 
matter--we just got fooled in one case, and we will probably 
never get fooled again. The GAO staffer might have gotten past 
that person in our Region I office near Philadelphia. I have my 
doubts. But that is an experiment that was not done.
    Getting past that person today in an office visit will be 
enormously harder, and ``once bitten, twice shy,'' as the old 
saying goes. NRC staffers are not going to get burned a second 
time with that particular scam. Our people are going to be very 
alert to it. The issue is, and what I commit to in my 
testimony, is we are going to do more red-teaming of ourselves 
in this area. We are going to look at our own vulnerabilities. 
We are going to be more vigilant on these lower-risk sources. 
And we intend to try our absolute best to find vulnerabilities 
and fix them before GAO points them out to us in the future.
    That is not a challenge to the GAO, but that is---- 
[Laughter.]
    Mr. McGaffigan. But that is what our intent is, and we have 
various ideas. The Chairman has some ideas about bringing DTRA, 
the Defense Threat Reduction Agency, in to look at our 
licensing process. We are going to red-team ourselves more 
seriously.
    I do not think we have vulnerabilities--I hope we do not--
at the top end of the spectrum because we have so much defense 
in depth there. But we have less defense in depth on these 
lower-risk sources, and we are going to find our 
vulnerabilities. That is a commitment.
    Senator Akaka. Well, as you heard, GAO identified a 
troubling vulnerability.
    Mr. McGaffigan. Yes.
    Senator Akaka. On the other hand, the use of radioactive 
sources is a necessary aspect of everyday life. We use these 
sources in medicine, as you mentioned, at hospitals and what we 
might call common places for diagnostic and cancer treatments 
and a wide variety of industrial uses.
    How do you balance and how does Congress balance the need 
to use the sources without significantly increasing costs and 
yet ensure that dangerous quantities of those materials are not 
easily available for use in a dirty bomb or other sources here?
    Mr. McGaffigan. Senator, that is a very good question. 
There are some very complex cases I could give to you. We will 
not let anybody use cesium in a large panoramic irradiator. We 
absolutely will not let them do that. There is an ongoing 
National Academy of Sciences report that is looking at smaller 
blood irradiators used in hospitals throughout the Nation. 
There are two blood irradiators at George Washington University 
Hospital a half-mile from the White House where the Vice 
President goes for care. Those are Category 2 sources under the 
Code of Conduct, and we have increased security on those 
sources.
    But the dispersability of the cesium-137 within them is a 
question--it is something that we are trying to fix. There are 
ways that we can make those sources more secure, less 
attractive to terrorists. But there are potentially tremendous 
costs involved for the hospitals and for the manufacturers, and 
we have a National Academy of Sciences study due to the 2005 
Energy Policy Act where they are trying--and they are going to 
report to us in September. They are trying to balance that 
cost/benefit calculation. How do we make small improvements, 
perhaps, at low cost to make those blood irradiators much less 
attractive to a terrorist?
    These are not easy issues, and we struggle with that 
routinely. Our bias is toward security, where security is 
effective but not overly costly. We do not protect the blood 
irradiators with guards and guns and gates and sensors. We 
protect them with a much tighter connection with local law 
enforcement. The hospitals today in a post-September 11 world 
have recognized this vulnerability. We have told them how to 
put extra sensors in. But we have also told them we are not 
going to have gun battles at George Washington University 
Hospital. We are going to make sure that you can summon the 
police, a lot of law enforcement real fast, if somebody tries 
to come in and attack those blood irradiators.
    It is a balance.
    Senator Akaka. Well, you mentioned, Commissioner, that the 
American public needs to understand better radiation, what it 
is and what are the effects of that. How do we, how does 
Congress, how do you, and how does the NRC do this?
    Mr. McGaffigan. It is something that every agency in 
government that deals with radiation, not just us but EPA, 
Health and Human Services, the Department of Homeland Security, 
and DOE, could do a better job at. EPA has a website where you 
can go and find out what extra dose you would get if you move 
to Colorado, which has much more uranium and thorium in the 
soil and you get much higher doses from that. In Colorado, it 
would also tell you that you would get a little bit of a higher 
dose from the altitude. It would tell you the extra dose if you 
live in a brick house as opposed to a wood house, or the extra 
dose from granite tabletops in your kitchen.
    But it is a dialogue that does not happen--it is pretty 
boring information. Should you have your home tested for radon? 
Should you accept your doctor's judgment that you should get a 
CT scan of your chest and abdomen? Should you avoid the 
Capitol? Senator, because you go back to Hawaii so often, you 
get a very large dose flying from here to Hawaii. The most 
exposed people in America, on average, in a large group are not 
the people who work at nuclear power plants. They are the 
people on airline crews who fly long distances. They get doses 
per year that are in the hundreds of millirems range, and we do 
not even badge them. In Europe they do. But we have not had 
this conversation with the public. I can tell you my personal 
view and what NRC regulates to and what other agencies regulate 
to. The annual dose for workers is 5,000 millirem. That is our 
limit. A CT scan of the chest and abdomen is about 2,000 
millirem. The average medical dose of Americans is about 340 
millirems per year for diagnostic procedures. When your child 
gets braces, they will probably get about 50 millirems when the 
whole-mouth x-rays are done in preparation for the braces being 
placed. In the Capitol and the Library of Congress, where there 
is lots of granite, people get 80 to 100 millirems per year if 
they work 2,000 hours, the typical work day, and most people 
work for longer in the Capitol.
    When my son was a page for Senator Warner back in 2001 
before September 11, in the spring of 2001, we mapped the 
Capitol using a radiation detector, and Tom Daschle's office 
was the hottest place we found. Just outside of his office at 
the time, it was about 40 microrems per hours.
    So what is a dangerous amount given that we live in a 
radioactive universe? That is the way it was created. It would 
not exist if it were not radioactive. And what is a dangerous 
amount? There are different views on that, and the government 
has a view, EPA, NRC, DOE, Health and Human Services. But 
certain other members of the public have a starkly different 
view, a much more alarmist view as to what happens if you take 
a plane flight or if you work in the Capitol, I guess. And the 
media tends to believe the truth is somewhere in between. One 
of the TV shows that I was on last night--I was on two TV news 
shows last night very briefly. That increased my total number 
of career TV news appearances to three. I had been on TV once 
before in my career. But the media tends to believe the truth 
must lie somewhere between what the government experts say, who 
obviously love gamma rays in their lives, and these alleged 
experts, one of whom was on one of the shows I watched last 
night, one of the TV news shows. And that person truly believes 
that we have to clean up Mother Nature, I believe, that we 
should get down to hundredths of a millirem per year doses when 
we clean up things.
    So there is a difference, and I hope that in an emergency, 
as the mayor of Seattle did in 2002, in the Top Officials 2 
exercise, that the mayor of Seattle will listen to the Federal 
Government experts and will try with the help of the State of 
Washington experts who were totally with us, to persuade the 
public that the risks they are taking are not large if they 
follow the Department of Homeland Security and Environmental 
Protection Agency guidelines. I hope that that will be the 
result.
    Senator Akaka. Well, thank you. I am going to pass it on to 
Senator Coleman for further questions. I will follow up after 
he is done with more questions.
    Mr. McGaffigan. OK.
    Senator Akaka. But here is one that can speak from the 
mayor's perspective.
    Senator Coleman. And I thank you, Senator Akaka. As a 
former mayor, these are issues that we have to have a better 
conversation with our citizens about because, at some point in 
time, this country is going to experience a dirty bomb attack. 
I cannot tell you this year or next year, but that is the world 
in which we live and the nature of the threat, and we cannot 
stop every bad thing from happening to us. And so it is all 
about how we respond and prepare.
    And perhaps out of this conversation, Commissioner, there 
is a dialogue that will help in that discussion.
    Mr. McGaffigan. I agree. I once tried to talk to the 
National Governors Association and I got blown off, several 
years ago, not exactly on this subject but on radiological 
threats. But the National Mayors Association, if they come to 
Washington, maybe we should have not me but Craig Conklin, say, 
from the Department of Homeland Security, who led the effort 
that resulted in the Department of Homeland Security's 
guidance, talk to them so that we are talking not in the middle 
of a crisis, but we are talking to them about our 
recommendations as the Federal Government and we are talking to 
mayors.
    The trouble is that the radiation experts are oftentimes 
many layers below the elected official, and they may agree with 
us, but they get to see the mayor never or once every 4 years.
    Senator Coleman. I will work with you and with the NRC to 
make that happen.
    There are two areas I just want to follow up on. How many 
Category 3 licenses does the NRC issue during the course of a 
year?
    Mr. McGaffigan. Well, we issue a total of 200, and Category 
3 portion has got to be a very small number.
    Senator Coleman. I want to get back to this issue of site 
visits. Why not simply say we are going to do site visits for 
Category 3 licenses, as Maryland does?
    Mr. McGaffigan. Well, the data--we could do site visits. 
When we are doing applications, whether it is with power 
reactors or with Category 3 licensees, we tend to try to put 
the cost on the applicant rather than on the American people. 
But we could probably do that. It is probably a relatively 
small reprogramming of money. We will take that into 
consideration.
    The number of site visits to applicants seeking Category 3 
material or even a factor of 10 below Category 3, well into 
Category 4, which would have been needed to get this particular 
application that the GAO put before us, the fraudulent 
application, is probably not a large expenditure of money, and 
we will look at that.
    We may get pushback. We have 34 Agreement States. Some of 
them are very large, and they may find other ways to check the 
bona fides of applicants. Some of these large States--I worked 
for Senator Bingaman from New Mexico. They are large but it 
seems everybody knows everybody. And there are ways to check 
out people without necessarily making the visit. And our 
budgets, NRC budgets, are more generous than many of these 
State budgets.
    We have to talk not only about our own actions but the 
actions of 34 other States. My understanding is, for your 
information--and it is probably not good for you--is that 
Minnesota was following our guidance in this area prior to the 
GAO sting--which made the visits discretionary. And our 
information is only five States that we have thus far gotten an 
answer from--including Maryland, act like Maryland and do 
mandatory visits. And they may be the more compact States.
    So we will consider your recommendation and see where we go 
with it. For the NRC it is possible.
    Senator Coleman. Let us have that conversation because I 
think it is clearly worthwhile. Again, we want to get as close 
to perfect as we can. There is not a lot of room for error 
here, and I do appreciate your reflection that fooled once, 
shame on you, fooled twice, shame on me, that clearly the level 
of alert has been raised and the warning levels have been 
raised. But I think systematically we should have something in 
place that moves us as close to perfection in this area where 
the risk of failure can be so great, so catastrophic.
    I just want to make one other comment. When you talked 
about the technical capacity of al-Qaeda, you did not diminish 
it, but you did question it. We're talking here about what it 
would take to move this material into a dirty bomb. I just have 
to say, knowing what we are dealing with in Iraq today with 
IEDs, the Defense Department asked for $6.4 billion in February 
of this year to counter-IED's, to counter the technological 
abilities of folks on the ground in Iraq. And I can tell you, 
having been there a number of times, we move to Level A and 
they go to Level B, and we go to Level C and they then go to 
Level D. And I think it would be a terrible mistake to 
underestimate the technological capability of this enemy. It 
would be a terrible mistake. And all you have to do is look at 
what we are dealing with, with IEDs, to understand the 
simplicity and complexity coming together and the devastating 
impact of that.
    So I just want to put that statement on the record.
    Mr. McGaffigan. I appreciate that, Senator. I spent most of 
my career--I have been in government for over three decades--
working on defense issues. We also have to guard against threat 
inflation. During the Cold War, inflation of the Soviet threat, 
the notion that the Soviets could march to the English Channel 
at a moment's notice and overwhelm NATO's capabilities was 
never real. They did not have the sustainability to do that. 
They did not have the cohesion. They did not have the training. 
But it was a tenet of our policy and it consumed large amounts 
of money to beat that threat that was being grossly 
exaggerated.
    So we also have to guard against threat inflation. We 
cannot make these people DOE National Laboratory capable. They 
have not evidenced that. Jose Padilla thought depleted uranium 
was something he could use in a dirty bomb, and that is not 
true. That 2004 paper talked about buying smoke alarms. It 
would take 2.3 million smoke alarms to get to the amount of 
material that GAO says it could have gotten. At $6 apiece, 
maybe you get a discount to $4, that would be pretty large sum 
of money. And then you would have to go through 2.3 million 
devices and try to get that little amount of Americium out.
    If that is where al-Qaeda was in 2004, sort of surfing the 
Internet--I am not trying to underestimate them, but they have 
a learning curve to go through to get to the point where we 
assume competence. We assume competence in attacking George 
Washington University Hospital. But we do not assume that they 
have the same degree of competence that the best National 
Laboratory would have.
    Senator Coleman. Again, we will not debate this, but I 
would think it would be a tragic mistake to underestimate the 
learning curve. And it is not only al-Qaeda, Padilla or 
whatever. There are others in this world who do not like us, 
who have great capacity. The IEDs that we are seeing in Iraq, 
there is real concern that Iranians are producing highly 
technical, highly sophisticated weaponry and putting it in the 
hands of folks who are killing American soldiers. And it would 
be a terrible mistake to underestimate the technical capacity 
of the enemies of this country who would have the ability to 
get radiological material and then to combine it in an 
explosive device. I really want to stress that.
    Mr. McGaffigan. I understand. If there is state help for 
the terrorists----
    Senator Coleman. And there is no reason to assume that this 
would not be the case in the world in which we are living 
today. We are seeing it on the ground right now where American 
soldiers are being killed by highly technical explosive devices 
that are being used on the ground by terrorists who did not 
think them up and make them themselves.
    Mr. McGaffigan. Right. We have to go after those countries 
if they ever do that, and I think we will be able to trace--if 
there is an RDD or a dirty bomb that ever gets set off in this 
country----
    Senator Coleman. And we have to presume that they are 
capable of doing it and do everything in our power to make sure 
that there is not a dirty bomb attack. We have to prevent it 
rather than just respond to it. We have to assume that the 
capability is there. And I think that is the correct assumption 
and that, when the GAO says you do not take it as seriously, 
you need to take it seriously.
    Mr. McGaffigan. We take it very seriously. If we are up 
against states----
    Senator Coleman. But you have to have the frame of mind 
that we have people who want to hurt us, who have the technical 
capacity, and assume the technical capacity and then make sure 
that we do all those things to make it more difficult, more 
difficult than it was when this sting took place, to get the 
material and then to inflict the damage. And I just think that 
is the mind-set that we need and the NRC might not be there 
yet. My sense, even in this discussion, is that I still think 
there needs to be a reflection, a greater reflection as to the 
danger that we face.
    Mr. McGaffigan. If states start aiding al-Qaeda in 
designing RDDs that, in the case of Americium----
    Senator Coleman. I will tell you today, Mr. Commissioner, 
that there are states aiding al-Qaeda. We know that in Iraq.
    Mr. McGaffigan. I understand. If there are states that do 
that and they use Americium, which is very hard to detect with 
the detectors that we have at our borders, that is a problem. 
That is a problem that the NRC cannot solve. Because it will 
have been brought into America covertly. But that is an act of 
war, in my view.
    Senator Coleman. Let us be prepared. I thank you for your 
efforts, Commissioner.
    Mr. McGaffigan. Thank you.
    Senator Akaka. Thank you very much, Senator Coleman.
    I want to just comment that Senator Coleman is correct to 
remind us that we have a thinking and learning enemy. And when 
Senator Coleman talks about prevention, it takes anticipation 
to deal with that and try to outthink or think beforehand what 
may be coming. I know in our country we do have a lot of young 
people who are doing so well in this area, and we need to use 
them well.
    Mr. Commissioner, we heard from GAO that suppliers do not 
believe it is their job to assess the validity of a license or 
licenses. I happen to disagree. Can you tell me if the NRC has 
any plans to require suppliers to make sure a licensee or its 
license is legitimate?
    Mr. McGaffigan. We have given guidance in the past. It 
probably has been at the Category 1 and 2 level. We definitely 
need to expand it to these sorts of devices. But we have given 
manufacturers and distributors very clear guidance in the past 
that they need to verify Category 1 and 2 materials, the 
legitimacy of the person seeking to buy, say, the gamma knife 
for Hospital X.
    As I said earlier, I am disappointed. Forty-five moisture 
density gauges being requested by a company that you have never 
heard of before should not have just set off dollar signs, 
$250,000 dollar signs in these people's head. They should have 
done some checking. That is a lot of moisture density gauges 
for a start-up company to buy. And if GAO had tried to buy 450, 
I hope and pray--and they had the $2.5 million to do it--that 
they would have said, ``My God, this is insane. Something is 
wrong here,'' and they should come to us.
    There is a limited number of people in the nuclear business 
dealing with devices at the Category 4 level, and including 
radionuclides of concern, not things like tritium that goes 
into exit signs, hear from the NRC. And we need to communicate 
with them. You are right, Senator Coleman is right. We need to 
make sure that they are alert and check with us if they have 
any doubt about the quantities being asked for of such devices.
    I do not expect them to call me when someone is buying one 
or two moisture density gauges, but 45 should have set off some 
bells and 450 should set off the largest bells we have in 
Washington. Everyone should be ringing.
    Senator Akaka. Mr. Commissioner, in a March 12, 2007, 
letter to the Environmental and Public Works Subcommittee on 
Clean Air and Nuclear Safety, Chairman Klein stated that one of 
the recommendations from the August 2003 GAO report on NRC 
control of radioactive sources remained open. That 
recommendation pertained to evaluation of the costs and 
benefits of requiring owners of generally licensed devices to 
apply for specific licenses and whether those costs are 
commensurate with the devices' risks.
    Chairman Klein said that the NRC would start the process of 
drafting a new rule for fiscal year 2007 that would look at 
which devices containing radioactive materials should be 
generally licensed and which were more dangerous and should be 
more tightly controlled through a specific license.
    Can you comment on the status of that initiative and what 
you believe the results might be?
    Mr. McGaffigan. I mentioned earlier the Commission has 
asked the staff to look at one-tenth of Category 3's lower 
threshold and to give us data on how expensive it would be, not 
just for us but for the 34 Agreement States, to license that.
    Generally licensed devices can go down well into the 
Category 5 range. We ask people to pay annual fees if they use 
generally licensed devices containing, say, Americium or cesium 
or cobalt. We are not really looking at going down into 
Category 5 quantities, even though we sometimes ask people to 
pay if they have something that is even down in the high part 
of Category 5.
    But we have something underway. Staff is going to give us 
recommendations. We are in the midst of the data gathering in 
2007. I think decisions by the Commission are likely to be made 
next year. And as I said, my bias is to specifically license to 
one-tenth of the lower threshold of Category 3, so halfway 
through Category 4 is my bias as I go into that, as we wait for 
the data to be collected. That is where we are headed, I think.
    Senator Akaka. When you say general licenses, I wonder 
whether that would mean you may have less what you may call 
``specific licenses.''
    Mr. McGaffigan. We have general licenses for things that we 
think are safe. The amount of material in the home smoke 
detector is about one-millionth of a curie of Americium. We 
worry down to ten-billionths of a curie of Americium. That is 
where the threshold is for certain reporting requirements, but 
despite the reporting requirements, you absolutely do not have 
to worry about such small quantities being useful in a dirty 
bomb. So we expect smoke detectors which are designed to our 
specs to be safe for your use in the home. We expect the exit 
signs that contain tritium around here, they have about 10 
curies of tritium in them. That sounds like a lot since we have 
been talking about micro- and millicuries, but you really need 
about 500,000 or a million curies of tritium to have any sort 
of dangerous quantity. And you still cannot do an RDD because 
tritium is heavy hydrogen that rises rapidly. It would be like 
a hydrogen balloon. I hope al-Qaeda is working on tritium RDDs, 
because it will be a great day, you will see a lot of balloons 
go up in the air, I guess.
    There is a rationality to what we do, where the thresholds 
are for these various radionuclides and where we feel it is 
safe for use in the home or use in the Capitol or wherever, and 
where additional controls are necessary, that is where we 
specifically license.
    Senator Akaka. Mr. Commissioner, I would like to ask a 
question that is not about how well NRC regulates who can buy a 
radioactive source, but about material that is even more 
accessible to terrorists, and that is lost or abandoned 
radioactive sources. And you mentioned there was a problem 
about these lost sources.
    In an August 2003 report, the GAO said that the NRC did not 
have a good record of how many sources were being used around 
the country because at that time no State or Federal agency 
tracked individual sealed sources. Instead, NRC and the 
Agreement States tracked numbers of specific licensees.
    Mr. McGaffigan. Right.
    Senator Akaka. However, in November 2006, NRC issued its 
final rule regarding establishment of a National Source 
Tracking System, a web-based system to enhance accountability 
for radioactive sources and provide a means for licensees to 
report the transfers of nationally tracked sources.
    What about sources that were being used prior to the 
establishment of the NSTS? How does the NSTS help the NRC 
Agreement States that the lost or abandoned radioactive sources 
may be sitting in, in an abandoned building or hospital, on the 
back of a stolen truck, or laying in an open field for anyone 
to pick up? So how does this work?
    Mr. McGaffigan. Sir, we have had since 2003 an interim 
database of Category 1 and 2 sources that has gotten better and 
better each year. We used it during the hurricanes in 2005 in 
Louisiana, and it was very helpful to us and highly accurate in 
terms of where Category 1 and 2 sources were. So the high-risk 
sources, we think we know where they are, even if they are 
sitting in a university and not being used at the moment.
    As somebody mentioned earlier, the Department of Energy is 
now very aggressively trying to gather sources of any category 
that people no longer want. What NRC did before September 11, 
2001--thanks to Greta Dicus, one of our previous 
Commissioners--we have jacked the fines up so that it is more 
expensive to pay our fines than to properly dispose of the 
source. Abandoning a small source can be a very expensive 
proposition. The classic case was in a steel mill, which would 
get contaminated because a small source would come in with a 
lot of other scrap.
    So we first tightened that, but then--and we were trying to 
make the responsibility be the licensees, the people who had 
these small sources, make them pay for the proper disposition. 
There are a lot of companies who will take them back. But we 
have pretty much abandoned that now, and DOE will pay for 
getting anybody's sources back from them, and that is a post-
September 11 change. And DOE does a very good job of it, in my 
view, their orphan source recovery program. We had some old 
sources left in even high schools that were sitting in closets, 
and this high school just could not justify sending it to J.L. 
Shepherd in California for whatever price J.L. Shepherd would 
charge them from taking the source off their hands. So they 
beat us, they outwaited us, and they now get DOE to do it for 
free. That is probably the right thing in a post-September 11 
world. We may have been trying to put responsibility where 
responsibility has been shirked before September 11. After 
September 11, we put the responsibility on government. If you 
have a source you want to have recovered, DOE prioritizes it. 
We help them find them. The Agreement States help them find 
them. And I think the quantity of orphan sources in this 
country has gone down a very large amount because of DOE. It is 
only because we do not know about it that an orphan source 
would be sitting out there nowadays.
    Senator Akaka. Commissioner McGaffigan, I want to thank you 
so much for all of your responses and your patience here. I 
also want to thank Senator Coleman for his patience here. Do 
you have any further questions?
    Senator Coleman. I have nothing further, Mr. Chairman.
    Senator Akaka. Well, I have other questions that I will 
submit for the record. I just want to note that the record will 
stay open for 15 days for questions for the record, and this 
Permanent Subcommittee on Investigations of the full Committee 
on Homeland Security and Governmental Affairs is now considered 
adjourned.
    [Whereupon, at 11:18 a.m., the Subcommittee was adjourned.]



































                            A P P E N D I X

                              ----------                              

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]


                                 
