Are These Towers Safe?
By MARK THOMPSON
The first hint of trouble would probably be no more than shadows flitting through the darkness outside one of the nation's nuclear power reactors. Beyond the fencing, black-clad snipers would take aim at sentries atop guard towers ringing the site. The guards tend to doubt they would be safe in their bullet-resistant enclosures. They call such perches iron coffins, which is what they could become if the terrorists used deadly but easily obtainable .50-cal. sniper rifles.
The saboteurs would break through fences by using bolt cutters or Bangalore torpedoes, pipe-shaped explosives developed by the British army in India nearly a century ago. The terrorists would blast through outer walls using platter charges, directed explosives developed during World War II, giving them access to the heart of the plant. They would use gun-mounted lasers and infrared devices to blind the plant's cameras, and electronic jammers to paralyze communications among its defenders. They would probably be armed with precious information--hand-drawn maps, drawings of control panels, weak spots in the site's defenses--provided by a covert comrade working inside the plant.
As they forced their way into the control room, many if not most of the attackers might die battling the remaining guards, but it was always a suicide mission. Once inside, the terrorists' hard work would be over. Then, surprisingly, would come the easy part: triggering a nuclear meltdown. They would spend a minute or two carefully flipping, disabling and breaking specific controls and switches, shutting down pumps and operating key valves. It would be a deadly sequence that they had mastered in advance from an accomplice who had probably worked in the control room of the reactor or another plant, maybe abroad. "They'd be trying to cause a loss-of-coolant accident that results in a meltdown," says David Lochbaum, a nuclear engineer who spent 17 years working in reactors. It may sound farfetched, but Lochbaum says causing a reactor catastrophe is really that simple. "It's irreversible once that last switch is flipped."
If everything went according to the terrorists' plan, radiation could begin spewing into the nighttime sky within 20 minutes, says Lochbaum, now a nuclear-safety engineer with the Union of Concerned Scientists, a nuclear-watchdog group. The lethal plume, drifting hundreds of miles downwind, could kill tens of thousands within a year and hundreds of thousands eventually.
That isn't some wild-eyed fantasy but what some experts fear is a realistic scenario. Many of the terrorists' tactics depicted here are taken from a Department of Energy (DOE) training video for guards at nuclear facilities. The control-room plot is based on the concerns of veterans from the nuclear industry. Physicist Kenneth Bergeron, who spent most of 25 years at Sandia National Laboratories researching nuclear-reactor safety, says plant operators focus security efforts on keeping bad guys out. They assume that no one with malicious intent will wind up at the controls and thus do not build in fail-safe mechanisms that would prevent a saboteur from engineering a catastrophe. As a result, says Paul Blanch, a nuclear-safety expert who oversaw reactors for Northeast Utilities in Connecticut for 25 years, "a knowledgeable terrorist inside a control room can cause a meltdown in fairly short order."
It has been nearly four years since 9/11 awakened the country to the possibility that nuclear power plants might be the next big target for the U.S.'s terrorist enemies. The country's reactors--deployed, as so many of them are, in areas with large civilian populations--have the potential to be weapons of mass destruction. The plants may be especially attractive to al-Qaeda because of the group's fondness for launching attacks that are increasingly spectacular. The vulnerability of the U.S. to terrorism was underscored when members of the 9/11 commission, formally disbanded last summer, resumed work as a nonprofit group last week and heard witnesses say the intelligence needed to prevent another major attack remained spotty.
Has the nuclear industry absorbed the lessons of 9/11 and made sufficient adjustments to the way plants are guarded? The DOE, which controls the 11 sites that house nuclear weapons and the materials used to build them, has significantly improved its standards. The Nuclear Regulatory Commission (NRC), which oversees 103 reactors run by private operators at 64 sites across 31 states, says it has too. "What is in place right now is sufficient to give us confidence that these plants will be able to defend themselves," NRC chairman Nils Diaz tells TIME. But a tightly held NRC document reviewed by TIME raises serious questions about whether the government has set the bar too low and allowed plant operators to skimp on security. Many guards working in nuclear plants and some senior security experts working for the U.S. government say the defenses facilities rely on are too meager to thwart an assault by a force the size of the one al-Qaeda put together when it attacked the U.S. on 9/11--Mohammed Atta's band of 19 hijackers. "The NRC and the nuclear power industry," says a senior U.S. antiterrorism official, "are today where the FAA [Federal Aviation Administration] and airlines were on Sept. 10, 2001." Whereas the U.S. has spent $20 billion improving aviation security since 9/11, it has spent $1 billion enhancing nuclear-plant security.
That al-Qaeda has eyed U.S. reactors is known. U.S. officials say Khalid Sheikh Mohammed, the captured architect of the 9/11 attacks, has told interrogators that his original plan was to have some of his pilots fly commandeered airplanes into nuclear power plants. According to the final report of the 9/11 commission, Atta, pilot of the first plane to hit the World Trade Center on 9/11, "had considered targeting a nuclear facility he had seen during familiarization flights near New York." At the dawn of the Iraq war in 2003, Arizona National Guard troops were ordered to the nation's largest nuclear-reactor complex, the Palo Verde Nuclear Generating Station near Phoenix, after U.S. intelligence heard that sleeper cells of Iraqi terrorists might attack it.
Though the idea of suicidal pilots crashing planes into reactors provoked sensational headlines after 9/11, studies commissioned by the NRC and the nuclear industry concluded that the chances of an aerial attack producing a major release of radioactivity are low. The NRC believes the concrete-and-steel containment shielding most portions of a nuclear plant would withstand being hit by an airplane. Other experts, including a recent National Academy of Sciences (N.A.S.) panel, disagree, saying the particular design and vulnerabilities of each plant make such blanket assurances meaningless.
In any case, the NRC does not require plant operators to defend against air attacks. A California antinuclear group, the Committee to Bridge the Gap, recently asked the NRC to order that shields of I-beams and steel cables be built around nuclear plants to stop airplanes from crashing into them. Antiaircraft batteries and the troops to operate them would also help but could pose hazards to innocent aircraft drifting off course. NRC officials say the likelihood of installing missiles or shields is virtually nil. The agency believes the place to thwart an aerial-attack plot is at the airport, not at the plant.
Yet terrorists may not need a dramatic skyborne attack to get the job done. They could take over a plant on foot. The key to understanding how the NRC has prepared for such an event is a standard called the design-basis threat, or DBT. The DBT is the regulatory worst-case scenario, the largest threat the NRC requires plants to train its guards to defeat.
Before 9/11, the agency required plants to be able to thwart an attack by little more than an armed gang--three outsiders equipped with handheld automatic weapons and aided by a confederate working inside the plant. After 9/11, when al-Qaeda showed the ability to produce 19 operatives for a suicide mission on a single day, some security specialists anticipated a significant hike in the DBT. But the number of attackers in the revised DBT is less than double the old figure and a fraction of the size of the 9/11 group. (The NRC regards the exact number as an official secret.) "The NRC has taken only baby steps to improve security at the nation's nuclear plants," Representative Edward Markey, a Massachusetts Democrat, told TIME last week.
And if al-Qaeda sent 19 or so terrorists to take over a nuclear plant? "I don't think they could handle a 9/11-size attack," says David Orrik, a senior NRC official who retired in February after a 20-year career probing power-plant vulnerabilities. The guards themselves have doubts. "These guys are coming in to die. They know they're not leaving," says a veteran guard at a U.S. nuclear power plant. "Our training has increased, but I don't think it's increased enough to deal with that." A guard at another plant agrees. "We don't have the weapons or training to stop an attack of that magnitude," he says. "Everyone feels that way. It's a consensus of opinion."
One limitation is the number of guards. The total protecting the nation's nuclear plants is 8,000, according to the Nuclear Energy Institute (NEI), the industry's lobbying arm. Numbers at specific locations aren't available, but that works out to roughly 80 per reactor. Broken down into four shifts, that's an average of 20 guards available to work at any one time. U.S. security officials at the Pentagon and the DOE say that is too small a number to take on a motivated group of suicidal terrorists who probably would be outfitted with weapons deadlier than the rifles used by guards.
Another issue is the lack of imagination in the scenarios used for training guards at private plants. TIME is refraining from publishing DBT specifics on the weapons that nuclear plants must defend against, but the relatively small arsenal that the NRC gives the "attackers" in its drills doesn't impress Representative Christopher Shays, a Connecticut Republican. The DBT attack force is barred from using many of the weapons detailed in the opening scenario of this story, but, says the Congressman, "if I were a terrorist, I'd feel more than free to use them." The agency doesn't require defenses against weapons that terrorists haven't regularly used, according to a senior nuclear-plant safety expert who has worked with the NRC and the nuclear industry for decades. "The NRC's assumption is that if it's not being used by the terrorists," he says, "it's not reasonable to assume it would suddenly start being used against nuclear power plants."
According to the NRC and the NEI, a force as big as Atta's band or anything bigger than the DBT is an "enemy of the state." That means it's the Pentagon's problem. "We recognize that there can be threats to our plants that are greater than what is defined by the DBT," Marvin Fertel, chief nuclear officer of the NEI has told Congress. "Although our security would provide an initial deterrence, at some point such threats are the responsibility of the Federal Government." That wouldn't necessarily do the plant's defenders any good, though. "They could call for the cavalry, but they'd never get there in time," Orrik says. "These things can be over in minutes."
On the NRC's website, the agency ducks the issue--after raising it in a Q&A--of whether today's nuclear plants are "capable of withstanding a 9/11-scale attack." Before 9/11, there was "reasonable assurance" that the guard force could defeat the then small DBT, the agency says. In the wake of 9/11, it continues, "the defensive capability of the industry has been significantly enhanced." But the website never answers the question it just posed. Could a 9/11-size terrorist force take down a U.S. nuclear power plant?
If Kathy Davidson's experience is any measure, there is a question whether plant security forces could even beat the DBT. Until May, Davidson was the chief guard trainer at Pilgrim Nuclear Station, south of Boston. The 16-year employee says she was fired from her $75,000-a-year job for complaining about poor security at the plant. Wackenhut Corp., the giant security company that employed her, says she was terminated for failing to improve security. "Security at the plant is pathetic," says Davidson. "It's just too confusing." Because there were too few guards, she says, each had to fulfill a different mission, depending on how an attack unfolded. "One person could have as many as seven places to go," she says. When Davidson complained, she says, she was told "to keep my mouth shut, that nothing was going to change." Since the plant's post-9/11 security plan took effect last fall, she tells TIME, there have been 29 in-house classroom exercises--with members of the guard force split into groups of "attackers" and "defenders"--designed to show how well the guards could defend the plant from terrorist attacks. "We won only one out of 29 tabletop drills using the new defensive plan," she says. "The attackers won 28." A senior Wackenhut official, who said "there is no win-lose ratio kept on these types of tabletops," contended that Davidson was fired for poor performance and that Pilgrim's defenses are improving.
The stakes could scarcely be higher. The toll of the 9/11 attacks would probably pale alongside a successful attack on a nuclear plant near a major metropolitan area. A recent study by Edwin Lyman, a physicist with the Union of Concerned Scientists, estimates that if terrorists triggered a meltdown at the Indian Point nuclear power plant, 35 miles north of New York City, as many as 44,000 people could die from radiation poisoning within a year, and as many as 518,000 could perish eventually from cancers spawned by the attack. Millions of people in the greater New York area would have to be permanently relocated, and economic losses could top $2 trillion. Lyman's study echoes the findings of one done by the Sandia National Laboratories for the NRC in 1982 that said as many as 50,000 early deaths could be caused by a reactor accident at Indian Point.
Nonsense, says the NEI's Fertel. The electric industry's research institute concluded that probably only about 100 people would be killed in such an attack, he says. In any case, Fertel has told Congress, the chances of terrorists provoking such a disaster are "so incredibly low it is not credible." One expert who thinks saboteurs would have a difficult time provoking a meltdown is Georges Le Guelte, a former board member of the International Atomic Energy Agency, who advises on nuclear-security issues at the Paris-based Institute of International and Strategic Relations. "It would require a relatively large number of highly experienced experts in nuclear technology to be able to intentionally provoke a nuclear accident from within a reactor," he says. Stephen Floyd, a vice president of regulatory affairs at the NEI, argues that terrorists wouldn't even try: "It doesn't seem very credible to us that terrorists would launch an attack against a nuclear power plant that's very heavily armed, especially when you look at other facilities that aren't so heavily defended that could cause great harm to the public as well." He points to chemical plants as an example.
For his part, Diaz insists that the improvements made in the nation's nuclear plants since 9/11 are adequate. They have included adding physical barriers, checking approaching vehicles at greater stand-off distances and improving coordination with local police and military authorities. Says the NRC chief: "Any terrorist who looks at one of these facilities is going to say, 'This is a hardened target, and I'm not going to have any confidence that I am going to be successful [attacking it].'" Plants have also improved training for guards and capped their workweeks at 72 hours to eliminate the not-uncommon tendency of overworked employees to fall asleep on duty. Previously, guards sometimes worked 80 to 90 hours a week.
The NRC chief says that when it comes to hiring, plant operators are using "a much finer-toothed comb" than before 9/11 to keep troublemakers out. Potential employees are screened through numerous databases, checked for, among other things, mental-health problems, criminal records and questionable behavior in previous jobs. The NRC's confidence in its "insider mitigation program" is so high that the DBT specifically rules out the need to defend against an "active violent insider"--a turncoat employee willing to shoot and kill fellow workers. The DBT does consider the possibility of a single, nonviolent insider working with the terrorists.
The Peach Bottom Atomic Power Station in southeastern Pennsylvania is a good place to see some of the enhancements ordered by the NRC after 9/11. The facility is newly ringed with 990 11-ton concrete blocks and $200-a-foot fencing topped with razor wire. Ten new guard towers--some six stories high--give armed guards broad vistas of possible approaches to the plant. "Since 9/11 we have more security officers here, and we've enhanced their weaponry," says Jeff Benjamin, a vice president of Exelon Corp., which operates the plant on the bank of the Susquehanna River. "We have a number of sensors, cameras and lighting," he told a visiting TIME correspondent, declining to elaborate for security reasons. The reactor itself is deep inside walls of concrete and steel. Says Benjamin: "All of the design and construction we do to keep bad stuff in is also pretty darn good at keeping bad stuff out."
Still, politicians from both parties question whether the NRC has done enough. Eight state attorneys general recently petitioned the NRC to require more security. The standard for protecting nuclear plants "remains essentially what it was in the 1970s," said one of their filings, sent to the NRC by New York's Eliot Spitzer. The NRC needs to bolster security at power plants "to reflect the realities of 2005, beginning with an immediate recognition of what we all learned on September 11, 2001."
Democrat Harry Reid, the Senate minority leader, has pushed proposals to enhance security, only to be defeated in the face of industry opposition. One bill would have required plants to defend themselves against a 9/11-size enemy force, perhaps aided by air-and-water-based attacks. Another would have created a federal Nuclear Security Force and a 20-member mock terrorist team to test the plants regularly, The NRC and industry representatives argued against such a federalized force on the ground that the close cooperation between plant operators and guards would be lost if federal employees were protecting the plants. "That would actually create almost a barrier between security and safety," Diaz tells TIME.
Representative Shays has ordered Congress's investigative arm, the Government Accountability Office, to find out why the revised DBT is so small. Shays, who chairs the House Reform Committee's panel on national security and emerging threats, told TIME he believes the DBT is "artificially low" because of economic pressures. "Rather than asking what security do we need, plant operators are asking how much security can we afford," he said.
The big gap between the security standards at DOE nuclear sites and those at the commercial plants overseen by the NRC adds fuel to the argument over what is prudent. In the wake of 9/11, the DOE boosted by 300% the size of the terrorist force its guards must be able to defend against. The DOE's DBT is classified, but experts inside and outside the government say it requires guards to defeat a 9/11-size force. While DOE sites are more sensitive than private ones, since they house nuclear weapons and their key components, the impact of a terrorist strike on either could be devastating. "The NRC, charged with the very same responsibility [as the DOE] of protecting nuclear facilities against terrorist attack, has fallen down on the job," Markey told TIME.
Some nuclear-security officials privately call the design-basis threat a "funding basis threat," suggesting the threat has been scaled back to meet the bottom line of what the industry was willing to pay for security. "The NRC is basically saying that what they're doing is as much as you can expect private industry to pay for," says Danielle Brian of the Project on Government Oversight, a nonprofit watchdog group.
The nation's big nuclear power companies seem to be making enough money to hire more guards, who earn an average of $35,000 annually. Chicago-based Exelon Corp., for example, whose 17 reactors make it the largest nuclear-plant operator in the U.S., saw its power-generation unit triple its income in the first quarter of 2005 compared with first quarter 2004, from $102 million to $320 million. Operators may be worried about future profits, since the increasing move to deregulate electricity has forced most nuclear plants to compete with other electricity producers, all of whom are seeking to sell power to utilities as cheaply as possible.
Even if the current security standards are sufficient, there is some question as to whether they will be properly enforced. Last year the NRC approved the NEI's request to hire the Wackenhut Corp. to test security at the nation's plants. Such exercises--suspended after 9/11, pending improvements--resumed last fall. Each plant is to be tested once every three years, which means the British-owned Wackenhut is running fake attacks twice a month.
But Wackenhut also provides security at about half the nation's nuclear reactors. "The very company that makes a living guarding nuclear power plants is also testing nuclear power plants' security," says Congressman Markey. "It's like a take-home exam." No one in the industry has forgotten that just before a mock attack against a DOE facility in 2003, Wackenhut "attackers" tipped off Wackenhut guards about the particulars of the drill. Under the new rules, NRC referees are supposed to pay close attention to ensure that Wackenhut's fake attackers aren't holding back when they launch a mock strike against a plant Wackenhut workers are defending. "It's going to be pretty obvious if the adversary force is taking it easy," says Richard Michau, president of Wackenhut's nuclear-services division. The NRC's Diaz says hiring Wackenhut was necessary to get a beefed-up fake-attack force on the job quickly. "I believe we have reached a very good compromise," he says, "with the NRC owning the exercise and Wackenhut planning for it."
The National Academy of Sciences raised a new issue when it released a report in April assessing the dangers posed by the 43,600 tons of spent nuclear fuel now resting in cooling pools at all 64 power plants across the country. Choking off the water that cools these pools could trigger a radioactive fire that some scientists believe could cause as much death and disease as a reactor meltdown. The panel of the N.A.S., which is private but has a mandate to advise the Federal Government on scientific matters, said it couldn't determine whether the plants and their spent-fuel pools could be defended against attack because the NRC decided the panel "did not have a need to know this information." But the report cast aspersions on the NRC's assessments of terrorist threats to nuclear plants, saying the agency does not consider the most lethal possibilities.
The panel concluded by warning that additional study of security at the nation's nuclear plants "is needed urgently." It said twice that the review should be done by someone "independent of the NRC and the nuclear industry." That's a frightening postscript. Since 9/11, virtually everything having to do with nuclear-plant security has been in the hands of the NRC and the nuclear industry. Diaz takes offense at the N.A.S.'s pointed snub of his agency's expertise. "The recommendation was not well justified," he says. "I don't believe we need anybody to come in and do it, because nobody can do it better than we can." --With reporting by Bruce Crumley/Paris
With reporting by Bruce Crumley/Paris