The National Nuclear Security Administration is scheduled this spring to release a long-awaited physical security infrastructure plan as it wrestles with outdated alarms, sensors, and other protective measures at its sites, the Government Accountability Office said in a report Tuesday.
The semiautonomous Department of Energy agency charged with sustaining the U.S. deterrent oversees four facilities that hold Category I and II special nuclear materials that represent the highest security threat if lost or misused, congressional auditors said. DOE itself manages another four such sites through various branches including its Office of Environmental Management, which oversees cleanup of Cold War nuclear waste.
The security threat burst into public view in 2012 when an 82-year-old nun and two fellow peace activists intruded deep into the Y-12 National Security Complex in Tennessee, one of the eight sites cited in this week’s report.
The NNSA just last month said it could require in excess of $1 billion in the coming decade to update crucial security infrastructure that includes intrusion detectors, fencing, anti-vehicle barriers, and alarm stations. Its upcoming report will set spending and scheduling priorities to address those physical security needs, according to the GAO.
In a statement Friday, the NNSA confirmed its intention to complete this spring the plan identifying the expense and timeline for addressing those security challenges. The agency “is committed to ensuring the highest level of security for its nuclear facilities and materials. Improving our processes for nuclear security reporting is an issue we take seriously,” according to the statement.
The Department of Energy is in “various stages of addressing physical security infrastructure challenges,” but it does not have its own plan, the GAO found. Without such guidance, “DOE officials and Congress will not have a comprehensive view of the challenge, and the future security of DOE sites holding category I and category II special nuclear material may be compromised,” congressional auditors said.
The GAO identified two broad security challenges shared by both agencies: evaluating and carrying out the security requirements set in a classified November 2016 design basis threat order, which establishes the size and adversary capabilities that facilities must be able to repel; and maintaining and updating their site physical security systems.
The Department of Energy also has not yet completely implemented across its nuclear complex the agency’s own June 2011 order regarding nuclear materials control and accounting – which is intended to ensure all such substances are where they should be and are being employed as intended. While the order required that implementation plans be in place within six months of publication, one facility would not complete its document until next year so that it could address higher-priority security needs first.
The Government Accountability Office also said DOE and NNSA mandatory annual reports to Congress in 2014 and 2015 on site nuclear security failed to fully meet federal internal control standards for “quality information”; specifically, the reports were not always provided on time, and they did not always provide information regarding the evaluations that supported findings that the facilities were secure.
As an example, the GAO said the Department of Energy’s 2015 report did not state whether two of the four facilities with Category I and II materials performed security vulnerability evaluations, and that there was no data on findings from the latest assessments at three locations.
The agencies attributed the missed deadlines on the lack of guidance on what data should be in the reports and the need for extensive internal reviews of the documents, the GAO said.
The GAO made four recommendations: The heads of the NNSA and DOE should provide more comprehensive data regarding the evaluations employed in their annual reports to demonstrate site security, and improve alignment between the internal review process for the reports to Congress and their publication schedules; DOE additionally should prepare a physical security infrastructure plan for its facilities and address delays to its material control and accountability directive in future annual reports to Congress.
The Department of Energy largely agreed with the recommendations, noting that it has already implemented the fourth recommendation and that its security committee is focused on development of the physical security infrastructure needs plan. However, the agency took exception to the assertion that its reports to Congress do not meet federal internal control standards.
In a March 17 response to the draft version of the GAO report, the Department of Energy urged that this finding be removed from the final version: “DOE and NNSA have made process improvement a fundamental aspect of our overall annual report process. Each reporting cycle has included a robust internal after action review process, and, as a result, each successive report has improved upon its predecessor and has been delivered in a more timely manner – the 2016 report significantly so.”
The Department of Energy did not respond to a request for additional comment regarding the GAO’s findings.
