GAO: Socioeconomic Risk of Dirty Bomb Use Unevenly Informs U.S. Nuclear Agencies’ Security Approaches
What is the primary consequence of a dirty bomb—one that contains radioactive material? According to a recent report by the U.S. Government Accountability Office (GAO), different agencies responsible for radiological security often share similar assessments of nuclear material threats and vulnerabilities, but they differ in their considerations around socioeconomic consequences, which affects their security activities.
“Recent security threats have raised concern that terrorists or other bad actors could target radioactive material for theft and use in a domestic attack,” said the report, Preventing a Dirty Bomb: Nuclear Regulatory Commission Has Not Taken Steps to Address Certain Radiological Security Risks. “From 2013 through 2023, the U.S. Nuclear Regulatory Commission (NRC) reported 4,356 nuclear materials events, which include instances of lost or stolen radioactive materials. In addition, from 1993 to 2023, the International Atomic Energy Agency reported 4,243 illegal or unauthorized activities and events worldwide involving nuclear and radioactive material, including incidents of trafficking and malicious use.”
Risk is measured by evaluating the threat, vulnerabilities, and consequences associated with a specific scenario or asset. In the case of a radioactive material risk, such as a dirty bomb, the GAO explains that the National Nuclear Security Administration (NNSA) and the Department of Homeland Security’s Countering Weapons of Mass Destruction Office (CWMD) pursue security activities based on a view of risk that primarily considers the socioeconomic consequences of a dirty bomb, including the denial of access to property, public panic, economic loss, and cleanup costs.
A 2019 radioactive material leak at the University of Washington’s Harborview Medical Center led to $156 million in damage, including impacts to more than 80 research programs and the forced relocation of more than 200 researchers and lab staff. The building had to be closed off from May 2019 through April 2021. The material leaked was about 1.25 curies of cesium-137—a category 4 quantity that wouldn’t even be subject to NRC regulation. A category 3 leak or higher (indicating a greater amount of radioactivity) would likely have significantly greater effects on livelihoods and socioeconomic factors.
NNSA uses information on socioeconomic consequences to help identify and advocate for the use of alternative, non-radioisotope technologies in specific industries to limit access to dangerous materials. CWMD uses this socioeconomic lens to inform budget requests for additional radiation detection equipment and training for state and local entities.
The NRC, however, does not apply a socioeconomic lens to its radiological risk mitigation plan. Instead, it focuses on fatalities and health effects as the primary consequences of concern when establishing regulations. Unless a dirty bomb includes a large quantity of radioactive materials, the health effects are likely to be limited in comparison to socioeconomic impacts, the GAO said.
“These differing focuses with regard to the consequences of a dirty bomb have resulted in NNSA and CWMD designing programs to secure radioactive materials that NRC regulations leave vulnerable,” the GAO report said.
Radioactive materials are commonly used for medical and industrial purposes. But if they fell into the wrong hands, they could be used to make a #DirtyBomb.
— U.S. GAO (@USGAO) October 3, 2024
GAO’s Allison Bawden discusses how to better secure #radioactive materials on our new podcast: https://t.co/B0VymiXEQV pic.twitter.com/K1R4D4XoPa
The GAO has made dozens of recommendations to key agencies—including the NRC—during the past 20 years to mitigate the risks posed by a dirty bomb. While the NNSA, CWMD, and Customs and Border Protection have implemented almost all of their GAO-recommended actions to address shortcomings in radioactive material security and risk mitigation, NRC has not implemented 11 of its 18 recommendations.
“Specifically, NRC has not taken actions to incorporate consideration of socioeconomic consequences into its regulations,” the report said. “It also has not strengthened the security of certain radioactive materials not subject to NRC's enhanced security requirements (“category 3” materials), such as by centrally tracking category 3 sources and licenses.”
In addition, NRC has not made significant changes to its radiological security regulations since 2013. Officials determined that any changes in the overall risk of a dirty bomb since then have not necessitated extra rulemaking.
The GAO recommended that NRC strengthen category 3 radioactive material source and license oversight, especially around verifying the legitimacy of material purchasers’ licenses and requiring on-site security reviews for unknown license applicants to verify they are prepared to implement the required security measures. The GAO also recommended the NRC increase security for category 3 materials.
During the last 10 years, the GAO has conducted a number of investigations that included fake businesses and fake licenses that demonstrated how a bad actor could take advantage of security gaps to obtain dangerous quantities of radioactive material. The GAO noted in its latest report that it continues “to believe that NRC cannot be assured of adequate security and oversight for category 3 materials without taking all of the actions we recommended.”
The report concluded: “Recent security threats have raised concern that terrorists or other bad actors could target radioactive material for theft and use in a domestic attack. Studies we reviewed and experts we previously convened agree that the socioeconomic consequences of a radiological attack, such as a dirty bomb, would be devastating. However, NRC has not implemented our recommendation to consider socioeconomic consequences in its decision-making regarding its assessment of risk for the development of security requirements. By not incorporating consideration of such consequences into its decision-making and, ultimately, its regulations, NRC cannot have assurance that its security requirements capture the full scope of risk for dangerous quantities of radioactive materials.”