2
TERRORIST ATTACKS ON SPENT FUEL STORAGE

This chapter addresses the final charge to the committee to “explicitly consider the risks of terrorist attacks on [spent fuel] and the risk these materials might be used to construct a radiological dispersal device.” The concept of risk as applied to terrorist attacks underpins the entire statement of task for this study. Therefore, the committee addresses this final charge first to provide the basis for addressing the remainder of the task statement.

The chapter is organized into the following sections:

  • Background on risk.

  • Terrorist attack scenarios.

  • Risks of terrorist attacks on spent fuel storage facilities.

  • Findings and recommendations.

2.1 BACKGROUND ON RISK

“Risk” is a function of three factors (Kaplan and Garrick, 1981):

  • The scenario describing the undesirable event,

  • The probability that the scenario will occur.

  • The consequences if the scenario should occur.

In the context of the present report, a scenario describes the modes and mechanisms of a possible terrorist attack against a spent fuel storage facility. For example, a scenario might involve a suicide attack with a hijacked civilian airliner. Another might involve a ground assault with a truck bomb. Several such scenarios are described later in this chapter and discussed in more detail in the committee’s classified report.

Probability is a dimensionless quantity that expresses the likelihood that a given scenario will occur over a specified time period. If the occurrence of a scenario is judged to be impossible, it would have a probability of 0.0. On the other hand, if the scenario were judged to be certain, it has a probability of 1.0. A scenario that had a 50 percent chance of occurrence during the period contemplated would have a probability of 0.5.

Consequences describe the undesirable results if the scenario were to occur. For example, a terrorist attack on a spent fuel storage facility could release ionizing radiation to the environment.1 The exposure of the public to this radiation could have both deterministic and stochastic effects. The former would occur from short-term exposures to very high doses of ionizing radiation, the latter to smaller doses that might have no immediate effects

1  

Terrorist scenarios and consequences are being described here for the sake of Illustration. One should not conclude from this description that the committee believes that such consequences would necessarily occur as the result of a terrorist attack on a spent fuel storage facility.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 25 2 TERRORIST ATTACKS ON SPENT FUEL STORAGE This chapter addresses the final charge to the committee to “explicitly consider the risks of terrorist attacks on [spent fuel] and the risk these materials might be used to construct a radiological dispersal device.” The concept of risk as applied to terrorist attacks underpins the entire statement of task for this study. Therefore, the committee addresses this final charge first to provide the basis for addressing the remainder of the task statement. The chapter is organized into the following sections: • Background on risk. • Terrorist attack scenarios. • Risks of terrorist attacks on spent fuel storage facilities. • Findings and recommendations. 2.1 BACKGROUND ON RISK “Risk” is a function of three factors (Kaplan and Garrick, 1981): • The scenario describing the undesirable event, • The probability that the scenario will occur. • The consequences if the scenario should occur. In the context of the present report, a scenario describes the modes and mechanisms of a possible terrorist attack against a spent fuel storage facility. For example, a scenario might involve a suicide attack with a hijacked civilian airliner. Another might involve a ground assault with a truck bomb. Several such scenarios are described later in this chapter and discussed in more detail in the committee's classified report. Probability is a dimensionless quantity that expresses the likelihood that a given scenario will occur over a specified time period. If the occurrence of a scenario is judged to be impossible, it would have a probability of 0.0. On the other hand, if the scenario were judged to be certain, it has a probability of 1.0. A scenario that had a 50 percent chance of occurrence during the period contemplated would have a probability of 0.5. Consequences describe the undesirable results if the scenario were to occur. For example, a terrorist attack on a spent fuel storage facility could release ionizing radiation to the environment.1 The exposure of the public to this print version of this publication as the authoritative version for attribution. radiation could have both deterministic and stochastic effects. The former would occur from short-term exposures to very high doses of ionizing radiation, the latter to smaller doses that might have no immediate effects 1 Terrorist scenarios and consequences are being described here for the sake of Illustration. One should not conclude from this description that the committee believes that such consequences would necessarily occur as the result of a terrorist attack on a spent fuel storage facility.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 26 but could result in cancer induction some years or decades later.2 Consequences also could be described in terms of economic damage. These could arise, for example, from the loss of use of the facility and surrounding areas or costs to clean up those areas. There also could be severe psychological consequences that could drive changes in public acceptance of commercial nuclear energy. The quantitative expression for the risk of a particular scenario, for example a suicide terrorist attack with a hijacked airliner, is (1) The total risk would be the sum of the risks for all possible independent attack scenarios. For example, if a spent fuel storage facility was determined to be vulnerable to attacks using airliners, truck bombs, and armed assaults, the total risk would be calculated as (2) Such equations are routinely used to calculate the risks of various industrial accidents, including accidents at nuclear power plants, through a process known as probabilistic risk assessment. Each accident is assigned a numerical probability based on a careful analysis of the sequence of failures (e.g., human or mechanical failures) that could produce the accident. The consequences of such accidents are typically expressed in terms of injurles, deaths, or economic losses. It is possible to estimate the risks of industrial accidents because there are sufficient experience and data to quantify the probabilities and consequences. This is not the case for terrorist attacks. To date, experts have not found a way to apply these quantitative risk equations to terrorist attacks because of two primary difficulties: The first is to develop a complete set of bounding scenarios for such attacks; the second is to estimate their probabilities. These depend on impossible-to-quantify factors such as terrorist motivations, expertise, and access to technical means.3 They also depend on the effectiveness of measures that might prevent or mitigate such attacks. In the absence of quantitative information on risks, one could attempt to make qualitative risk comparisons. Such comparisons could estimate, for example, the relative risks of attacks on spent fuel storage facilities versus attacks on commercial nuclear power reactors or other critical infrastructure such as chemical plants. Although a comparison of such risks is beyond the scope of this study, the committee recognizes that policy decisions about spent fuel storage may need to take into account such comparative risk issues, print version of this publication as the authoritative version for attribution. 2 Such cancers would likely not be directly traceable to the radiation dose received from a terrorist attack and would likely be indistinguishable from the large population of cancers that result from other causes. 3 Political scientists and counter-terror specialists have argued whether terrorists seek headlines, casualties, or both (e.g., Jenkins 1975, 1985), The September 11, 2001, attacks in the United States and the March 11, 2004, attacks in Spain demonstrate that some terrorists, particularly those of al-Qaida and its allies, intend to commit mass murder and/or mass economic disruption, both of which may have important political consequences. Further information about the motivation of terrorists is provided in NRC (2002).

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 27 especially for decisions regarding the expenditure of limited societal resources to address terrorist threats. The 2002 National Research Council report Making the Nation Safer: The Role of Science and Technology in Countering Terrorism framed this issue as follows (NRC, 2002, P. 43): The potential vulnerabilities of NPPs [nuclear power plants] to terrorist attack seem to have captured the imagination of the public and the media, perhaps because of a perception that a successful attack could harm large populations and have severe economic and environmental consequences. There are, however, many other types of large industrial facilities that are potentially vulnerable to attack, for example, petroleum refineries, chemical plants, and oil and liquefied natural gas supertankers. These facilities do not have the robust construction and security features characteristic of NPPs, and many are located near highly populated urban areas. Groups seeking to carry out high-impact terrorism will likely choose targets that have a high probability of being attacked successfully.4 If success is measured by the number of people killed and injured or the permanent destruction of property, then spent fuel storage facilities may not make good terrorist targets owing to their relatively robust construction (see Chapters 1 and 3) and security. Industrialized societies like the United States provide terrorists a large number of “soft” (i.e., unprotected) targets that could be attacked more easily with greater effect than spent fuel storage facilities. These include chemical plants, refineries, transportation systems, and other facilities where large numbers of people gather (see NRC, 2002). On the other hand, there are other success criteria that might influence a terrorist's decision to attack a “hard” (i.e., robust or well protected) target such as a commercial nuclear power plant and its spent fuel storage facilities. Such attacks could spread panic and shut down the power plant for an extended period of time even with no loss of life. Moreover, an attack that resulted in the release of radioactive material could threaten the viability of commercial nuclear power. These considerations led the committee to conclude that it could not address its charge using quantitative and comparative risk assessments. The committee decided instead to examine a range of possible terrorist attack scenarios in terms of (1) their potential for damaging spent fuel pools and dry storage casks; and (2) their potential for radioactive material releases. This allowed the committee to make qualitative judgments about the vulnerability of spent fuel storage facilities to terrorist attacks and potential measures that could be taken to mitigate them. print version of this publication as the authoritative version for attribution. 4 This point was made to the committee in a briefing by the Department of Homeland Security, where “success” means that the terrorist was able to achieve the goals of the attack, whatever they might be.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 28 2.2 TERRORIST ATTACK SCENARIOS It is possible to imagine a wide range of terrorist attacks against spent fuel storage facilities. Each would have a range of potential consequences depending on the characteristics of the attack and the facility being targeted as well as any post-attack mitigative actions to prevent or reduce the release of radioactive material. The committee focused its discussions about terrorist attacks around the concept of a maximum credible scenario—that is, an attack that is physically possible to carry out and that produces the most serious potential consequences within a given class of attack scenarios. The following example illustrates the concept: One of the scenario classes considered by the committee in this chapter involves suicide attacks against spent fuel storage facilities with civilian passenger aircraft. The physics of such attacks are well understood: In general, heavier and higher-speed aircraft produce greater impact forces than lighter and slower aircraft, all else being equal. Consequently, the maximum credible scenario for suicide attacks involving civilian passenger aircraft would utilize the largest civilian passenger aircraft widely used in the United States flying at maximum cruising speed and hitting the facility at its most vulnerable point. Such an attack provides an upper bound to the damage that could be inflicted by this type of aircraft attack. The maximum credible scenario is particularly useful for obtaining a general understanding of the damage that could be inflicted, but it would not necessarily apply to every spent fuel storage facility. To be judged a “credible” scenario, the terrorist must be able to successfully carry it out as designed—for example, to hit a spent fuel storage facility with the largest civilian aircraft at its most vulnerable point. This would rule out attacks that are physically impossible, such as flying a large civilian aircraft into a facility that is located below ground level or protected by surrounding hills or buildings. This also would rule out attacks invoking weapons that are not available to terrorists (e.g., aircraft-launched weapons such as “bunker-buster” bombs or nuclear weapons). This is not intended, however, to rule out attacks that are judged to have a low probability for success simply because terrorists might lack the skill and knowledge or luck to carry them out. In fact, if the consequences of such attacks were severe, policy makers might still decide that prudent mitigating actions should be taken regardless of their low probabilities of occurrence.5 This might be especially true if quick, inexpensive fixes could be implemented. The main benefit of analyzing the maximum credible scenario is that it provides decision makers with a better characterization of the full range of potential consequences so that sound policy judgments can be made. The analyses carried out for the Nuclear Regulatory Commission (described in the committee's classified report) do not consider maximum credible scenarios. Instead, the analyses employ reference scenarios that are based either on the characteristics of previous terrorist attacks or on qualitative judgments of the technical means and methods that might be employed in attacks against spent fuel storage facilities. Although such reference scenarios are useful for gaining Insights on potential consequences of terrorist attacks, they print version of this publication as the authoritative version for attribution. 5 The Department of Energy, for example, routinely examines the consequences of very low probability events involving nuclear weapons safety and security; see, for example, AL 56XB Development and Production Manual published by the U.S. Department of Energy, National Nuclear Security Administration. See http://prp.lanl.gov/documents/d_p_manual.asp.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 29 are not necessarily bounding. This becomes important when the reference scenario attack results in damage to a facility that verges on failure. The committee prefers a maximum credible scenario approach for one important reason: It believes that terrorists who choose to attack hardened facilities like spent fuel storage facilities would choose weapons capable of producing maximum destruction. Of course, once the consequences of such attacks are known, an element of expert judgment is required to determine whether such attacks have a high likelihood of being carried out as designed. Such judgment is especially important when making policy decisions about actions to reduce the vulnerabilities of facilities to such attacks. The consequences of terrorist attacks can be described in terms of either maximum credible releases or best- estimate releases. The former describes the largest releases of radioactive material following an attack based on quantitative analytical models (e.g., the MELCOR computer code described in Chapter 3). The latter describes the median estimates from such models. In both cases, the estimates may not account for mitigative actions that could be taken after an attack to reduce or even eliminate releases. The Nuclear Regulatory Commission analyses reviewed by the committee in its classified report are best-estimate releases for various terrorist attack scenarios. The estimates in NUREG-1738 (USNRC, 2001 a) and Alvarez et al. (2003a). on the other hand, describe maximum-credible to worst-case releases.6 The committee considered four classes of terrorist attack scenarios in this study: • Air attacks using large civilian aircraft or smaller aircraft laden with explosives. • Ground attacks by groups of well-armed and well-trained individuals. • Attacks involving combined air and land assaults, • Thefts of spent fuel for use by terrorists (including knowledgeable insiders) in radiological dispersal devices. The committee devoted time at its meetings discussing these scenarios, it also received briefings on possible scenarios from Nuclear Regulatory Commission staff and suggestions for scenarios from the Department of Homeland Security (DHS), other experts, and the public. Some scenarios were dismissed by the committee as not credible. An example of such a scenario is an attack on a spent fuel storage facility with a nuclear weapon. Such weapons would be relatively difficult7 for terrorists to build or steal. Even if such a weapon could be obtained, the committee can think of no reason that it would be used against a spent fuel storage facility rather than another target. There are easier ways to attack spent fuel storage facilities, as discussed in the classified report, and there are more attractive targets for nuclear weapons, for example, large population centers. print version of this publication as the authoritative version for attribution. 6 Worst-case releases are based on the most unfavorable conditions that could occur in a given scenario, regardless of whether those conditions were physically realistic. For example, a worst-case estimate of the radionuclide releases from an attack on a spent fuel pool might assume that all of the volatile radionuclides contained in the spent fuel would be released, even if quantitative analytical models showed that such releases were very unlikely to occur 7 Difficult but certainly not impossible. See Chapter 2 in NRC (2002).

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 30 Given the experience of September 11, 2001, and the attacks that have occurred in other parts of the world, it is clear to the committee that the ability of the most capable terrorists to carry out attacks is limited only by their access to technical means. It is probably not limited by the ability of terrorist organizations to recruit or train attackers or bring them and any needed equipment into the United States—if indeed they are not already here. Moreover, the demonstrated willingness of terrorists to carry out suicide attacks greatly expands the scenarios that need to be considered when analyzing potential threats. As is discussed in some detail in Chapters 3 and 4, the facilities used to store spent fuel at nuclear power plants are very robust. Thus, only attacks that involve the application of large energy impulses or that allow terrorists to gain interior access have any chance of releasing substantial quantities of radioactive material. This further restricts the scenarios that need to be considered. For example, attacks using rocket-propelled grenades (RPGs) of the type that have been carried out in Iraq against U.S. and coalition forces would not likely be successful if the intent of the attack is to cause substantial damage to the facility. Of course, such an attack would get the public's attention and might even have economic consequences for the attacked plant and possibly the entire commercial nuclear power industry. The threat scenarios summarized in this chapter are based on documents provided to the committee, briefings received at committee meetings, and the committee's own expert judgment.8 Further overview and information on nuclear and radiological threats in general can be found in the NRC (2002) report and references therein. 2.2.1 Air Attacks The September 11, 2001, attacks9 demonstrated that terrorists are capable of successfully attacking fixed infrastructure with large civilian jetliners. The security of civilian passenger airliners has been improved since these attacks were carried out, and the vulnerability of civilian passenger aircraft to highjacking has been reduced. Nevertheless, the committee judges, based on the evidence made available to it during this study, that attacks with civilian aircraft remain a credible threat. Such aircraft are used routinely in freight and charter services, and large numbers of such aircraft enter the United States from other countries each day. Improvements to ground security or cargo inspection would likely not eliminate the threat posed by an air crew willing to stage a suicide attack with a chartered air freighter. Although the September 11, 2001, attacks utilized Boeing 757 and 767 airliners, larger aircraft (Boeing 747, 777; Airbus 340) are in routine use around the world, and an even larger aircraft (Airbus 380) is entering production. Assaults by such large aircraft could impart enormous energy impulses to spent fuel storage facilities. Additionally, attacks with print version of this publication as the authoritative version for attribution. 8 The committee found limited information in the open literature on various scenarios for terrorist attacks on nuclear plants and their spent fuel storage facilities. 9 The al-Qaida terrorist organization hijacked and crashed two Boeing 767 airliners into Towers 1 and 2 of the World Trade Center building in New York and a Boeing 757 airliner into the Pentagon building in Arlington, Virginia. A second Boeing 757, which was believed to be targeted either on the White House or the U.S. Capitol (see National Commission on Terrorist Attacks Upon the United States, Staff Statement No, 16 [Outline of the 9/11 Plot], pages 18–19) crashed in an open field near Jennerstown, Pennsylvania.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 31 aircraft carrying large fuel loads could produce fires that would greatly complicate rescue and recovery efforts. Previous studies on aircraft crash impacts (Droste et at., 2002; Lange et al., 2002; HSK, 2003; RBR Consultants, 2003; Thomauske, 2003) suggest that the consequences of a heavy aircraft crash on a nuclear installation depend on factors such as the following: • Type and design of the aircraft. • Speed of the aircraft. • Fuel loading of the aircraft and total weight at impact. • Angle-of-attack and point-of-impact on the facility. • Construction of the facility. Location of the target with respect to ground level (i.e., below or above grade).10 • • The presence of surrounding buildings and other obstacles (e.g., hills, transmission lines) that might block certain potential flight paths into the facility. In other words, the consequences of such attacks are scenario- and plant-design specific. It is not possible to make any general statements about spent fuel storage facility vulnerabilities to air attacks that would apply to all U.S. commercial nuclear power plants U.S. commercial nuclear power plants are not required by the Nuclear Regulatory Commission to defend against air attacks. The Commission believes that it is the responsibility of the U.S. government to implement security measures to prevent such attacks. The commercial nuclear industry shares this view. The Nuclear Regulatory Commission staff informed the committee that the Commission has directed power plant operators to take steps to reduce the likelihood of serious consequences should such attacks occur. The staff also informed the committee that the Commission may issue additional directives once the vulnerability analyses it is sponsoring at Sandia National Laboratories are completed. These analyses are described in the committee's classified report (see also Chapters 3 and 4 in this report). 2.2.2 Ground Attacks Ground attacks on a nuclear facility could take three forms: (1) a direct assault on the facility by armed groups, (2) a stand-off attack using appropriate weapons, or (3) an assault having both air and ground components. The direct assault would likely be carried out by a group of well-armed and trained attackers, perhaps working with the assistance of an insider. The objective of such an attack would likely be to gain entry to protected and vital areas of the plant (FIGURE 2.1) to carry out radiological sabotage. The attackers would need to have knowledge of the design, location, and operation of the spent fuel facility to carry out such an attack successfully. Commercial nuclear power plants are required by the Nuclear Regulatory Commission to maintain a professional guard force at each plant to defend against a Commission-developed design basis threat (DBT), which includes a ground assault. The protective force is a critical part of a nuclear power plant's security system for print version of this publication as the authoritative version for attribution. deterring, 10 All current dry cask storage facilities in the United States are constructed at ground level, whereas spent fuel pools can be located above or below grade, depending on plant design (see Chapter 3).

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 32 FIGURE 2.1 Commercial nuclear power plant sites are demarcated as shown for security purposes. The part of the power plant site over which the plant operator exercises control is referred to as the owner-controlled area. This usually corresponds to the boundary of the site. Located within this area are one or more protected areas to which access is restricted using guards, fences, and other barriers. Dry cask storage facilities, formally referred to as independent Spent Fuel Storage Installations (ISFSIs), are located within these areas. The vital area of the plant contains the reactor core, support buildings, and the spent fuel pool. It is the most carefully controlled and guarded part of the plant site. SOURCE: Modified from Nuclear Regulatory Commission briefing materials (2004). detecting, thwarting, or impeding attacks. The Commission staff declined to provide a formal briefing to the committee on the DBT for radiological sabotage, asserting that the committee did not have a need to know this information. Nevertheless, the committee was able to discern the details of the DBT from a series of presentations made by Nuclear Regulatory Commission staff. Commission staff also provided a fact check of this information as the classified report was being finalized. Power plant operators are required to demonstrate to the Commission's satisfaction that there is “high assurance” that their guard forces can thwart the Commission-defined DBT assault. This guard force also must be able to provide deterrence against a beyond-DBT attack depending on the adversarial force. Reinforcing forces print version of this publication as the authoritative version for attribution. would be provided by local and state law enforcement as well as federal forces. The Commission staff also informed the committee that since the September 11, 2001, attacks, the Commission has been working with DHS to improve coordination procedures with federal, state, and local agencies to improve their response capabilities in the event of an attack. DHS also is making grants to local law enforcement agencies around power plant sites to raise their capabilities to respond to requests for assistance.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 33 Since the September 11, 2001, attacks, the Nuclear Regulatory Commission has issued directives to power plant operators to enhance protection against vehicle bombs. The Commission also has issued directives to power plant operators to enhance protection against insider threats. The committee does not have enough information to judge whether the measures at power plants are in fact sufficient to defend against either a DBT or a beyond-DBT attack on spent fuel storage. The Nuclear Regulatory Commission declined to provide detailed briefings to the committee on surveillance, security procedures, and security training at commercial nuclear power plants. Consequently, the committee was unable to evaluate their effectiveness, A recent General Accounting Office report (GAO, 2003) was critical of some of these procedures, but the committee has no basis for judging whether these criticisms were justified. Nevertheless, the committee judges that surveillance and security procedures at commercial nuclear power plants are just as important as physical barriers in preventing successful terrorist attacks and mitigating their consequences. 2.2.3 Attacks Having Both Air and Ground Components Hybrid attacks that combine aspects of both air and ground attacks also could be mounted by terrorists. These could deliver attacking forces directly to a spent fuel storage facility, bypassing the security perimeters and security personnel deployed to protect against a ground attack. The committee considered various scenarios for such attacks. The committee judges that some scenarios are feasible. Details are provided in the classified report. 2.2.4 Terrorist Theft of Spent Fuel for Use in a Radiological Dispersal Device (RDD) An RDD, or so-called dirty bomb, is a device that disperses radioactive material using chemical explosives or other means (NRC. 2002) RDDs do not involve flssion-induced explosions of the kind associated with nuclear weapons. While RDD attacks can be carried out with any source of radioactivity, this discussion is confined to scenarios that involve the theft of spent fuel for such use.11 A crude RDD device could be fabricated simply by loading stolen spent fuel onto a truck carrying high explosives. The truck could be driven to another location and detonated. The dispersal of radioactivity from such an attack would be unlikely to cause many immediate deaths, but there could be fatalities from the chemical explosion as well as considerable cleanup costs and adverse psychological effects. It would be difficult for terrorists to steal a large quantity of spent fuel (e.g., a single spent fuel assembly) for use in an RDD for three reasons. First, spent fuel is highly radioactive and therefore requires heavy shielding to handle. Second, the use of heavy equipment would be required to remove spent fuel assemblies from a pool or dry cask. Third, controls are in place at plants to deter and detect such thefts. Additional details on these controls are provided in the classified report. Theft and removal of an assembly or individual fuel rods during an assault on the plant might be easier, because the guard force would likely be preoccupied defending the plant. However, the amount of material that could be removed would be small, and getting it print version of this publication as the authoritative version for attribution. 11 An attack on a spent fuel facility that resulted in the direct release of radioactivity would be an act of radiological sabotage of the kind considered previously in this chapter.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 34 out of the plant would be time consuming and obvious to the plant defenders and other responding forces. There are broken fuel rods and other debris, mostly from older assemblies, in storage at many plants. These materials are typically stored along the sides of the spent fuel pools and could be more easily removed from the plant than an entire assembly. Pieces of fuel rods also are sometimes intentionally removed from assemblies for offsite laboratory analysis. Some plants have misplaced fuel rod pieces.12 A knowledgeable insider might be able to retrieve some of this material from the pool, but getting it out of the plant under normal operating conditions would be difficult. Even the successful theft of a part of a spent fuel rod would provide a terrorist with only a relatively small amount of radioactive material. Superior materials could be obtained from other facilities. This material also can be purchased (Zimmerman and Loeb, 2004). Moreover, even with explosive dissemination, it is unlikely that much of the spent fuel will be aerosolized unless it is incorporated into a well-designed RDD. More likely, such an event would break up and scatter the fuel pellets in relatively large chunks, which would not pose an overwhelming cleanup challenge. Even though the likelihood of spent fuel theft appears to be small, it is nevertheless important that the protection of these materials be maintained and improved as vulnerabilities are identified. 2.3 RISKS OF TERRORIST ATTACKS ON SPENT FUEL STORAGE FACILITIES Nuclear Regulatory Commission staff told the committee that it believes that the consequences of a terrorist attack on a spent fuel pool would likely unfold slowly enough that there would be time to take mitigative actions to prevent a large release of radioactivity. They also pointed out that since the September 11, 2001, attacks, the Nuclear Regulatory Commission has issued several orders that contain Interim Compensatory Measures that require power plant operators to consider potential mitigative actions in the event of such an attack. The committee received a briefing on some of these measures at one of its meetings. According to Commission staff, such measures provide an additional margin of safety. The nuclear industry and the Nuclear Regulatory Commission have also asserted that the robust construction and stringent security requirements at nuclear power plants13 make them less vulnerable to terrorist attack than softer targets such as chemical plants and refineries (e.g., Chapin et al., 2002). They argue that scarce resources should be devoted to print version of this publication as the authoritative version for attribution. 12 For example, at the Millstone and Vermont Yankee plants in 2000 and 2003, respectively. In the case of Millstone, the Nuclear Regulatory Commission determined on the basis of extensive analysis that these rods were likely disposed of as low- level waste. After the committee's classified report was published, Commission staff informed the committee that Vermont Yankee had accounted for the missing rod segments and that Humbolt Bay had uncovered and is investigating an inventory discrepancy involving spent fuel rod segments. 13 These arguments tend to be generic in nature and do not differentiate spent fuel pools from the rest of the power plant.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 35 upgrading security at these other critical facilities rather than at already well-protected nuclear plants. There are two unstated propositions in the argument that nuclear plants are less vulnerable than other facilities. The first speaks to the probability of terrorist attacks on such facilities; the second speaks to the consequences: • Proposition 1: Nuclear power plants (and their spent fuel facilities) are less desirable as terrorist targets because they are robust and well protected, • Proposition 2: If attacked, nuclear plants (and their spent fuel storage facilities) are likely to sustain little or no damage because they are robust and well protected. The committee obtained a briefing from the Department of Homeland Security to address the first proposition. Details are provided in the classified report. While the committee's classified report was in review, the National Commission on Terrorist Attacks Upon the United States issued a staff paper (Staff Statement No. 16, Outline of the 9/11 Plot, pages 12–13) suggesting that al-Qaida initially included unidentified nuclear plants among an expanded list of targets for the September 11, 2001, attacks. According to that report, these plants were eliminated from the target list along with several other facilities when the terrorist organization scaled back the number of planned attacks. Nevertheless, if this information is correct, it provides further indications that commercial nuclear power plants are of interest to terrorist groups,14 even though softer targets may have a higher priority with many terrorists. With respect to the first proposition, the committee judges that it is not prudent to dismiss nuclear plants, including their spent fuel storage facilities, as undesirable targets for attacks by terrorists. As to the second proposition that terrorist attacks are likely to cause little or no damage, a poorly designed attack or an attack by unsophisticated terrorists might produce little physical damage to the plant There could, however, be severe adverse psychological effects from such an attack that could have considerable economic consequences. On the other hand, attacks by knowledgeable terrorists with access to advanced weapons might cause considerable physical damage to a spent fuel storage facility, especially in a suicide attack. It is important to recognize that an attack that damages a power plant or its spent fuel facilities would not necessarily result in the release of any radioactivity to the environment. While It may not be possible to deter such an attack, there are many potential mitigation steps that can be taken to lower its potential consequences should an attack occur. These are discussed in some detail in the committee's classified report (see also Chapters 3 and 4 in this report). print version of this publication as the authoritative version for attribution. 14 In another example of concern, police in Toronto, Canada, detained 19 men in August 2003 based on suspicious activities that included surveillance and flying lessons that would take them over a nuclear power plant (Ferguson et al., 2004).

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 36 In summary, the committee judges that the plausibility of an attack on a spent fuel storage facility, coupled with the public fear associated with radioactivity, indicates that the possibility of attacks cannot be dismissed. 2.4 FINDINGS AND RECOMMENDATIONS With respect to the committee's task to “explicitly consider the risks of terrorist attacks on [spent fuel] and the risk these materials might be used to construct a radiological dispersal device,” the committee offers the following findings and recommendations: FINDING 2A: The probability of terrorist attacks on spent fuel storage cannot be assessed quantitatively or comparatively. Spent fuel storage facilities cannot be dismissed as targets for such attacks because it is not possible to predict the behavior and motivations of terrorists, and because of the attractiveness of spent fuel as a terrorist target given the well-known public dread of radiation. Terrorists view nuclear power plant facilities as desirable targets because of the large inventories of radionuclides they contain. The committee believes that knowledgeable terrorists might choose to attack spent fuel pools because (1) at U.S. commercial power plants, these pools are less well protected structurally than reactor cores; and (2) they typically contain inventories of medium- and long-lived radionuclides that are several times greater than those contained in individual reactor cores. FINDING 2B: The committee judges that the likelihood terrorists could steal enough spent fuel for use in a significant radiological dispersal device is small. Spent fuel assemblies in pools or dry casks are large, heavy, and highly radioactive. They are too large and radioactive to be handled by a single individual. Removal of an assembly from the pool or dry cask would prove extremely difficult under almost any terrorist attack scenario. Attempts by a knowledgeable insider(s) to remove single rods and related debris from the pool might prove easier, but it would likely be very difficult to get it out of the plant under normal operating conditions. Theft and removal during an assault on the plant might be easier because the guard force would likely be occupied defending the plant. However, the amount of material that could be removed would be small. Moreover, there are other facilities from which highly radioactive material could be more easily stolen, and this material also can be purchased. Even though the likelihood of spent fuel theft appears to be small, it is nevertheless important that the protection of these materials be maintained and improved as vulnerabilities are identified. RECOMMENDATION: The Nuclear Regulatory Commission should review and upgrade, where necessary, its security requirements for protecting spent fuel rods not contained in fuel assemblies from theft by knowledgeable insiders, especially in facilities where individual fuel rods or portions of rods are being stored in pools. FINDING 2C: A number of security improvements at nuclear power plants have been instituted since the events of September 11, 2001. The Nuclear Regulatory Commission did not provide the committee with enough information to evaluate the effectiveness of these procedures for protecting stored spent fuel. print version of this publication as the authoritative version for attribution.

OCR for page 25
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the TERRORIST ATTACKS ON SPENT FUEL STORAGE 37 Surveillance and security procedures are just as important as physical barriers in preventing and mitigating terrorist attacks. The Nuclear Regulatory Commission declined to provide the committee with detailed briefings on the surveillance and security procedures that are now in place to protect spent fuel facilities at commercial nuclear power plants against terrorist attacks. Although the committee did learn about some of the changes that have been instituted since the September 11, 2001, attacks, it was not provided with enough information to evaluate the effectiveness of procedures now in place. RECOMMENDATION: Although the committee did not specifically investigate the effectiveness and adequacy of improved surveillance and security measures for protecting stored spent fuel, an assessment of current measures should be performed by an independent15 organization. print version of this publication as the authoritative version for attribution. 15 That is, independent of the Nuclear Regulatory Commission and the nuclear industry.