ML071870143

Comment (22) of Diane Curran on Behalf of the San Luis Obispo Mothers for Peace Opposed to Supplement to Environmental Assessment for Diablo Canyon, ISFSI

ML071870143
Person / Time
Site:	Diablo Canyon
Issue date:	07/02/2007
From:	Curran D Harmon, Curran, Harmon, Curran, Spielberg & Eisenberg, LLP, San Luis Obispo Mothers for Peace
To:	Rulemaking, Directives, and Editing Branch
References
72FR30398 00022
Download: ML071870143 (94)

Text

Page Iot I NRCREP - Comments on Supplement to Diablo Canyon Environmental Assessment From: "Diane Curran" <dcurran@harmoncurran.com>

To: <NRCREP@nrc.gov>

Date: 07/02/2007 1:44 PM

Subject:

Comments on Supplement to Diablo Canyon Environmental Assessment CC: <jrh@nrc.gov>, "Gordon Thompson" <gthompson@irss-usa.org>, <janeslo@kcbx.net>, <jzk@charter.net>,

<gradofcal @ yahoo.com>, <hankliz @ charter.net>, <morgan.rafferty @ gmail.com>

C-BY E-MAIL TO: -] rr Chief, Rulemaking, Directives and Editing Branch Mail Stop T6-D59 ---

U.S. Nuclear Regulatory Commission

-H45 Washington, D.C. 20555-0001 --

NRCREP@nrc.gov -

SUBJECT:

Supplement to Environmental Assessment for Diablo Canyon, ISFSI, Docket No. 72-26

Dear Madam/Sir:

On behalf of the San Luis Obispo Mothers for Peace, I am responding to your request for public comment on the Supplement to the Environmental Assessment and Draft Finding of No Significant Impact Related to the Construction and Operation of the Diablo Canyon Independent Spent Fuel Storage Installation (May 29, 2007) ("EA Supplement").

SLOMFP's concerns about the gross inadequacy of the EA Supplement to satisfy the National Environmental Policy Act are presented in SAN LUIS OBISPO MOTHERS FOR PEACE'S CONTENTIONS AND REQUEST FOR A HEARING REGARDING DIABLO CANYON ENVIRONMENTAL ASSESSMENT SUPPLEMENT ("SLOMFP's Contentions and Hearing Request"), which SLOMFP filed with the NRC Commissioners on June 28, 2007, and corrected on June 29, 2007. A corrected copy of SLOMFP's Contentions and Hearing Request, including the attached declaration and expert report of Dr. Gordon Thompson, is attached.

Please treat SLOMFP's Contentions and Hearing Request as its comments on the EA Supplement.

Thank you for your consideration.

Sincerely, Diane Curran Cc: James R. Hall, Senior Project Manager Licensing Branch NRC Division of Spent Fuel Storage and Transportation jrh @nrc.gov San Luis Obispo Mothers for Peace

-6 ~

6aV )S, e - ~

(~y~ /7L~)

file://C:\temp\GW }00001 .HTM 07/02/2007

11c:\temp\GWJ0001 1.TMP Peýq-e TV]

I~c:\temp\GW}OOO1 1.TMP Pal Mail Envelope Properties (4689397C.5 IF: 1 : 25887)

Subject:

Comments on Supplement to Diablo Canyon Environmental Assessment Creation Date Mon, Jul 2, 2007 1:45 PM From: "Diane Curran" <dcurran@harmoncurran.com>

Created By: dcurran@harmoncurran.com Recipients nrc.gov TWGWPO01 .HQGWDO01 NRCREP nrc.gov OWGWPO04.HQGWDO01 JRH CC (James Randall Hall) gmail.com morgan.rafferty CC charter.net hankliz CC jzk CC yahoo.com gradofcal CC kcbx.net janeslo CC irss-usa.org gthompson CC (Gordon Thompson)

Post Office Route TWGWPOO1 .HQGWDO01 nrc.gov OWGWPOO4.HQGWDOO1 nrc.gov gmail.com charter.net yahoo.com kcbx.net irss-usa.org Files Size Date & Time MESSAGE 1610 Monday, July 2, 2007 1:45 PM

c:\temp\GW)0001 1.TMP Page ?2!1 I c:\temp\GW}OOO1 1.TMP Page 2~I TEXT.htm 8057 0401 DC corrected conts and hearing request 6-29-07.pdf 60918 0401 GT Thompson Declaration 6-27-07.pdf 36364 0401 Thompson CV 10-06.pdf 42593 401 GT Thompson Report 6-27-07.pdf 183137 Mime.822 455367 Options Expiration Date: None Priority: Standard ReplyRequested: No Return Notification: None Concealed

Subject:

No Security: Standard Junk Mail Handling Evaluation Results Message is eligible for Junk Mail handling This message was not classified as Junk Mail Junk Mail settings when this message was delivered Junk Mail handling disabled by User Junk Mail handling disabled by Administrator Junk List is not enabled Junk Mail using personal address books is not enabled Block List is not enabled

June 28, 2007 CORRECTED JUNE 29, 2007 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE COMMISSION In the matter of Docket # 72-26-ISFSI Pacific Gas and Electric Company Diablo Canyon Nuclear Power Plant Unit Nos. 1 and 2 Independent Spent Fuel Storage Installation SAN LUIS OBISPO MOTHERS FOR PEACE'S CONTENTIONS AND REQUEST FOR A HEARING REGARDING DIABLO CANYON ENVIRONMENTAL ASSESSMENT SUPPLEMENT I. INTRODUCTION AND

SUMMARY

Pursuant to the U.S. Nuclear Regulatory Commission's ("NRC's" or "Commission's") Order in Pacific Gas andElectric Co. (Diablo Canyon Power Plant Independent Spent Fuel Storage Installation), CLI-07-11, 65 NRC 148 (2007) ("CLI 011"), San Luis Obispo Mothers for Peace ("SLOMFP") hereby submits its contentions regarding the Supplement to the Environmental Assessment and Draft Finding of No Significant Impact Related to the Construction and Operation of the Diablo Canyon Independent Spent Fuel Storage Installation (May 29, 2007) ("EA Supplement").

SLOMFP requests the Commission to hold a formal adjudicatory hearing on its contentions, as required by 10 C.F.R. §§ 2.105(a)(7), 2.700 and 2.714(b).l Although 10 C.F.R. §2.714 was superseded in 2004 by 10 C.F.R. § 2.2.309 and §§ 2.105(a)((7) and 2.700 were changed to allow the NRC to conduct informal hearings on ISFSI license applications (69 Fed. Reg. 2,182 (January 14, 2004)), SLOMFP believes the former versions of these regulations apply because this proceeding began before the 2004 changes to the NRC's procedural regulations were promulgated.

SLOMFP's contentions are supported by the declaration and expert report of Dr.

Gordon Thompson, Assessing Risks of PotentialMalicious Actions at Commercial Nuclear Facilities.: The Case of a ProposedIndependent Spent Fuel Storage Installation at the Diablo Canyon Site (June 27, 2007) ("Thompson Report"). Copies of Dr.

Thompson's declaration, report, and curriculum vitae are attached.

The EA Supplement purports to address the environmental impacts of intentional attacks on the Diablo Canyon spent fuel storage facility, in response to the U.S. Court of Appeals for the Ninth Circuit's decision in San Luis Obispo Mothersfor Peace v. NRC, 449 F.3d 1016 ( 9 th Cir. 2006), cert. denied, 127 S.Ct. 1124 (2007) ("Mothersfor Peace").

While the EA Supplement concedes that some types of attacks on the Diablo Canyon independent spent fuel storage installation ("ISFSI") are plausible, it asserts that the.

environmental impacts of attacks would be insignificant. Therefore the NRC. Staff has decided not to prepare a full-fledged environmental impact statement ("EIS") that would provide a more detailed analysis of the environmental impacts of attacks on the facility and would also evaluate the comparative costs and benefits of a range of alternatives to avoid or mitigate those impacts.

Unfortunately, the NRC Staff has done a very poor job of evaluating the environmental impacts of intentional attacks on the Diablo Canyon facility. The EA distorts and minimizes the environmental impacts of attacks on the facility by using hidden and unjustified assumptions. As a result, the EA Supplement fails to consider a range of credible attacks that could cause significant damage to the human environment.

The EA supplement also fails to identify the key documents on which it relies, thus making it impossible for any party or reviewing court to verify the appropriateness of its 2

reliance on those documents. In addition, the EA Supplement fails to address the U.S.

government's major plan for protection of critical infrastructure and key resources, the National Infrastructure Protection Plan ("NIPP") (2006). Finally, the EA fails to comply with NEPA because it does not consider the significant cumulative impacts of the proposed ISFSI in relation to the impacts of the existing high-density pool storage system for spent fuel at the Diablo Canyon nuclear plant.

As a result of these profound deficiencies, the EA Supplement completely fails to demonstrate that the NRC made a "fully informed and well-considered" determination of no significant impacts. Blue Mountains Biodiversity Projectv. Blackwood, 161 F.3d 1208, 1211 ( 9 th Cir. 1998), cert. denied sub nom. MalheurLumber Co. v. Blue Mountain Biodiversity Project,527 U.S. 1003 (1999). NEPA requires the NRC to go back to the drawing board and provide an analysis that is understandable and scientifically supported.

As discussed below in Section III, SLOMFP's contentions satisfy the NRC's late-filing criteria in 10 C.F.R. § 2.714(b).

II. CONTENTIONS Contention 1: Failure to define terms, explain methodology or identify scientific sources The EA violates NEPA and NRC and Council on Environmental Quality ("CEQ")

implementing regulations because it fails to document the basis for the NRC Staff's determination that the environmental impacts of intentional attacks on the Diablo Canyon ISFSI are insignificant, by failing to define its terms, explain its methodology, or identify its scientific sources. Therefore, the EA fails to justify the Staff's decision not to prepare an EIS for the facility.

3

Basis: As the U.S. Court of Appeals for the Ninth Circuit ruled in Idaho Sporting Cong. v. Thomas, 137 F.3d 1146, 1150 (9th Cir. 1988), NEPA requires that an agency must provide the public with "a basis for evaluating the impacts" of a proposed action, including "hard data" relied on by the agency's experts. The purpose of this requirement is two-fold: (a) to protect "a plaintiff's ability to challenge an agency action," and (b) to allow a court to review an agency's NEPA decision without "second guessing" the agency's "scientific conclusions." Id. See also EarthIsland Inst. V United States Forest Ser., 351 F.3d 1291, 1300-31 ( 9 th Cir. 2003), citing Marsh v. Ore. NaturalRes. Council, Inc., 490 U.S. 360, 377(1989) (a reviewing court must be able to independently review the record in order to satisfy itself that the agency has made a reasoned decision based on its evaluation of the evidence). Consistent with these judicial interpretations of NEPA, NRC regulation 10 C.F.R. § 51.30(a)(2) requires that an EA must provide a "list of agencies and persons consulted, and identification of sources used." CEQ regulation 40 C.F.R. § 1502.24 also requires that:

Agencies shall insure the professional integrity, including scientific integrity, of the discussions and analyses in environmental impact statements. They shall identify any methodologies used and shall make explicit reference by footnote to the scientific and other sources relied upon for conclusions in the statement. An agency may place discussion of methodology in an appendix.

While Section 1502.24 nominally applies to EISs, the U.S. Court of Appeals has also applied it to evaluate the adequacy of EAs. See Idaho Sporting Congress, 137 F.3d at 1150.

The Diablo Canyon EA Supplement does not comply with NEPA, 10 C.F.R. § 51.30(a)(2) or 40 C.F.R. § 1502.24 because it fails to describe the methodologies used by the NRC Staff or to provide the underlying data on which it relied. In fact, the EA does 4

not even identify the documents that the NRC Staff reviewed in preparing its environmental analysis.

a. Failure to define terms or explain methodology The EA fails to define its terms or explain its methodology in the following respects:

i. The EA fails to provide a clear description of the NRC's process for identifying plausible or credible attack scenarios and assessing their consequences to determine whether they are significant. The EA does not describe the types of attack scenario that the NRC considered in preparing the EA, the types of attack scenario that were disregarded, or why the NRC considered or disregarded any particular scenario.

Some information about the considered and disregarded scenarios can be inferred from other information, leading to the conclusions stated below in Contention 3. Inference by the reader should not be required, however. The EA should define its terms directly and precisely.

ii. The reader is given no explanation of what the NRC means by the word "plausible." This is a grave omission, because the NRC's initial determination of whether attack scenarios are "plausible" established the scope of impacts considered in the EA. EA at 6. The term requires explanation, because it is clear from the EA that "plausible" means something to the NRC that is different from or in addition to its ordinary meaning of "credible." For instance, a number of factors relevant to a determination of plausibility were not evaluated until after the NRC made the plausibility determination, i.e., "iconic value," "complexity of planning required," "resources needed," and "execution risk." Id. Moreover, as stated below in Contention 3, above, the 5

NRC disregarded attack scenarios that are plausible by any reasonable definition, including scenarios that would yield radiological impacts much larger than those considered in the EA.

iii. Just as the Pa'ina Irradiator EA rules out attack scenarios that are "remote or speculative" (page B-5), it is reasonable to infer that the Diablo Canyon EA 2

does the same. But neither the Diablo Canyon EA nor the Pa'ina Irradiator EA provides any description of the criteria used by the NRC to distinguish between scenarios that are "plausible" and those that are "remote and speculative." Given that the NRC has asserted the probability of an intentional attack on a nuclear facility "cannot be reliably quantified" (EA Supplement at 6), it is important for the EA to provide qualitative criteria for determining whether attacks are remote and speculative.

iv. The EA does not describe any analysis performed by the NRC Staff for the specific purpose of complying with NEPA. Instead, it describes an analysis that apparently took place in 2002, long before the Ninth Circuit's decision, and that apparently was based on compliance with NRC's AEA-based security requirements. EA Supplement at 6. The scope of threat scenarios covered by the AEA-based standard of reasonable protection or the Design Basis Threat rule's standard of requiring defense "against which a private security force can reasonably be expected to defend" (72 Fed.

2 On June 1, 2007, almost contemporaneously with the issuance of the Diablo Canyon EA Supplement, the NRC issued a supplemental appendix to the draft EA for the Pa'ina Irradiator in Hawaii which purported to address the environmental impacts of attacks on the irradiator. Drift Environmental Assessment for Pa'ina Irradiator, Appendix B:

Consideration of Terrorist Attacks on the Proposed Pa'ina Irradiator ("Pa'ina Irradiator EA"). See http://www.nrc.gov/materials/paina.pdf. The Pa'ina Irradiator EA is useful in analyzing the EA for the Diablo Canyon facility because it provides additional insight into the NRC's criteria for determining what attack scenarios it would consider in the EA.

The Pa'ina Irradiator EA is also deficient for many of the same reasons as the Diablo Canyon EA.

6

Reg. 12,705 12,713 (March 19, 2007)) is narrower than the scope of scenarios covered by the NEPA standard of reasonable foreseeability in 40 C.F.R. 1502.22(b)(3). The EA Supplement fails to demonstrate that the NRC considered the wider scope of scenarios required by NEPA.

v. To the extent that the EA Supplement describes the analytical steps taken by the NRC in its 2002 analysis, the process is poorly described. According to the EA Supplement, the analysis had four steps: (1) "Initially, the NRC screened threat scenarios to determine plausibility;" (2) "NRC assessed the attractiveness of the facility to attack by taking into account factors such as iconic value, complexity of planning required, resources needed, execution risk, and public protection measures;" (3) "NRC made conservative assessments of consequences, to assess the potential for early fatalities from radiological impacts;" and (4) "NRC then looked at the combined effect of the attractiveness and the consequences analyses, to determine whether additional security measures for ISFSIs were required." EA Supplement at 6.

This description raises many questions that go unanswered in the EA Supplement.

For instance:

" Why isn't the attractiveness of the facility to attack a plausibility consideration? If attractiveness of the facility is not a plausibility consideration, then how does the NRC define plausibility?

• How is "iconic value" determined?

" By what standard did the NRC evaluate "complexity of planning required," "resources needed," and "execution risk?"

7

• What are "public protection measures?" Do they constitute security plans, emergency planning, or something else? How are "public protection measures" relevant to the "attractiveness of the facility?" How is the criterion of "public protection measures" different than "execution risk?"

• Did the NRC avoid discussing significant impacts by assuming that public protection measures would prevent the attacks? Such an assumption would defeat a key purpose of an environmental assessment, which is to evaluate scenarios that are low in probability but credible, i.e., scenarios for which "protective measures" can be circumvented or do not exist.

vi. In describing "generic assessments" that "formed the basis for the NRC's conclusion that there was no need for further security measures at ISFSIs beyond those currently required by the regulation" (EA Supplement at 7), the NRC Staff fails to explain how this general analysis of licensee compliance with Atomic Energy Act-based security regulations and orders has any relevance to a NEPA determination of whether environmental impacts are significant.

vii. The NRC asserts that it "reviewed the analyses done for the ISFSI security assessments, and compared the assumptions used in these generic assessments to the relevant features of the Diablo Canyon ISFSI" (Id.), determining that the assumptions in these generic security assessments were. "representative" or "conservative" in relation to the Diablo Canyon facility. The NRC fails to explain how that determination was factored into a NEPA analysis.

viii. The EA Supplement fails to provide any analysis of the radiological impacts of threat scenarios, including any documented estimate of the 8

radiation dose arising from release of radioactive material. The only statement made by the EA Supplement is that the dose "would likely be below 5 rem." Id. at 7.

In short, the NRC Staff's description of the analytical process it used to reach a finding of no significant impact is unintelligible. The EA Supplement's dismal failure to provide an understandable explanation of its methodology violates NEPA's requirement to take a "hard look" at environmental impacts and disclose the nature of that hard look.

Blue Mountains Biodiversity Project, 161 F.3d at 1211.

b. Failure to reference sources of scientific data The EA supplement's only list of "references" consists of three documents that are irrelevant and invalid in light of the U.S. Court of Appeals decision in San Luis Obispo Mothersfor Peace v. NRC: the 2003 license amendment application, theoriginal 2003 EA, and the license itself. Yet, the drafters of the EA Supplement clearly consulted other sources of data and information. For instance, the EA Supplement describes several internal review processes that the NRC Staff apparently relied on in preparing its environmental analysis:

• "Following issuance of the 2002 security orders for ISFSIs, NRC used a security assessment framework as a screening and assessment tool, to determine whether additional security measures, beyond those required by regulation and the security orders, were warranted for NRC's regulated facilities, including ISFSIs." EA Supplement at 6.

""Initially, NRC screened threat scenarios to determine plausibility." Id.

"For

' those scenarios deemed plausible, NRC assessed the attractiveness of the facility to attack ... " Id.

• ". . . NRC made conservative assessments of consequences, to assess the potential for early fatalities from radiological impacts." Id.

" "NRC... looked at the combined effect of the attractiveness and the consequences analyses, to determine whether additional security measures for ISFSIs were necessary." Id.

• "In conducting the security assessments for ISFSIs, NRC chose several spent fuel storage cask designs that were representative of most currently NRC-certified designs." Id. at 6-7.

9

" The Staff reached a "conclusion that there was no need for further security measures at ISFSIs beyond those currently required by regulation and imposed by orders issued after September 11, 2001." Id. at 7.

" The Staff "reviewed the analyses done for the ISFSI security assessments, and compared the assumptions used in these generic assessments to the relevant features of the Diablo Canyon ISFSI." Id. at 7.

• The Staff made a determination "that the assumptions used in these generic security assessments, regarding the storage cask design, the source term (amount of radioactive material released) and the atmospheric dispersion, were representative, and in some cases conservative, relative to the actual conditions at the Diablo Canyon ISFSI." Id.

Thus it appears from the EA Supplement that the NRC Staff may have engaged in as many as nine separate reviews that informed the Staff's environmental review in this case

- yet the EA Supplement fails to list any of these reviews as references.

Under NEPA, the NRC is required to disclose the technical basis for its determination that the environmental impacts of licensing the Diablo Canyon ISFSI are insignificant. The public is also entitled to review that technical basis. Idaho Sporting Cong., 137 F.3d at 1150. Therefore SLOMFP seeks identification and access to any security studies or other data relied on by the NRC in reaching its conclusion that the environmental impacts of the proposed spent fuel storage facility are insignificant.

SLOMFP understands that these studies and data may constitute safeguards or classified information, and intends to request access to them under appropriate protective 3

measures.

Contention 2: Reliance on hidden and unjustified assumptions.

The EA Supplement fails to satisfy NEPA because the NRC's decision not to prepare an EIS is based on hidden and unjustified assumptions.

3 SLOMFP's attorney, Diane Curran, and one of its experts, Dr. Edwin S. Lyman, have active Level L security clearances.

10

Basis: As the U.S. Court of Appeals for the Fifth Circuit held in South Louisiana Envtl. Council v. Sand, 629 F.2d 1005, 1011-12 (5th Cir. 1980), an agency's reliance on misleading assumptions violates NEPA by "impairing the agency's consideration of the adverse environmental effects of a proposed project." See also Johnston v. Davis, 698 F.2d 1088, 1094 (10th Cir. 1983) (holding that misleading or unqualified statements that do not represent a realistic assessment of environmental impacts violate NEPA); Hughes Watershed Conservancy v. Glickman, 81 F.3d 437, 446 ( 4th Cir. 1999) (rejecting an EIS that contained misleading projections of a proposed project's economic benefits).

Here, the EA Supplement violates NEPA by relying on hidden and unjustified assumptions. For instance, the EA Supplement appears to assume that the environmental impacts of an attack on a spent fuel storage cask would be insignificant if they do not result in early fatalities. This assumption is not completely clear, but can be inferred from the document's discussion of consequences. In considering the consequences of potential releases of radioactive material, the NRC has employed only one indicator, namely "the potential for early fatalities." EA at 6. The Staff thus appears to have used early fatalities as a criterion to screen out consideration of any threat scenarios that cause impacts other than early fatalities.

To exclude consequences other than early fatalities is absurd. The adverse health effects of a successful attack on the Diablo Canyon ISFSI would include increased cancers and illnesses (Thompson Report at 17, 35), which indisputably constitute 4

significant adverse environmental impacts that are routinely considered in NRC's EISs.

4 See, e.g., NUREG- 1767, Vol. 1, Environmental Impact Statement on the Construction and Operation of a Proposed Mixed Oxide Fuel Fabrication Facility at the Savannah 11

Moreover, as discussed in Dr. Thompson's report, land contamination -- the dominant impact of spent-fuel-storage conventional accidents or attacks - is a very serious impact that can render uninhabitable a large land area, causing significant economic and social impacts. Id.

The EA Supplement also appears to assume that the environmental impacts of an attack on a spent fuel storage cask would be reduced to the point of insignificance by unspecified emergency planning upgrades. Id. at 7. According to the EA Supplement, these measures "could" mitigate the impacts of an attack on the Diablo Canyon ISFSI.

Id. The EA Supplement's discussion is insufficient to satisfy NEPA because but it does not refer to any specific emergency planning measures that could be assessed for their effectiveness, nor does Pacific Gas and Electric Company's license application for the spent fuel storage facility include any new or upgraded emergency planning measures for the Diablo Canyon ISFSI.

Contention 3: Failure to consider credible threat scenarios with significant environmental impacts.

In violation of NEPA and CEQ regulation 40 C.F.R. § 1502.22(b)(3), the EA fails to consider credible threat scenarios that could cause significant environmental damage by contaminating the environment.

Basis: CEQ regulation 40 C.F.R. § 1502.22(b)(3) requires the NRC to consider low-probability environmental impacts with catastrophic consequences, if those impacts are reasonably foreseeable. The EA Supplement creates the appearance of compliance with § 1502.22(b)(3) by claiming to consider all "plausible" attack scenarios. Id. at 6.

River Site, South Carolina, Table 4.14 (2005), which provides an estimate of "latent" cancer fatalities as a result of facility accidents.

12

But the EA Supplement fails to consider credible scenarios that could cause significant environmental damage. As discussed in the Thompson Report at page 33, it may be inferred from the very small dose consequences estimated in the EA Supplement that the EA Supplement examined scenarios that caused only minimal damage to a storage module.5 As discussed in Dr. Thompson's report at pages 33-37, the EA Supplement fails to consider credible scenarios in which penetration of a spent-fuel canister is accompanied by the use of an incendiary device to ignite the zirconium cladding of the spent fuel. Scenarios of this type could be implemented by a relatively small group of attackers using weapons and devices that are readily available to sub-national groups, causing a release of radioactive material much larger than the EA has considered. For instance, penetration of the overpack of a storage module and the multi-purpose canister

("MPC") could be readily accomplished using a shaped charge, a device that is commonly used in the mining and petroleum industries and therefore well-known and available. Id. An attack on storage modules could be accomplished through a variety of means, including direct contact, firing of guided missiles from a distance, or the use of small aircraft as improvised cruise missiles. Id. at 35-36.

Such an attack could lead to penetration of several canisters and zirconium combustion within the canisters, causing the release of a substantial fraction of the volatile radionuclides, notably cesium-137, that are present in the affected canisters.

Consequences of such a release could include the contamination and rendering 5 It is impossible to discern the NRC Staff's reasoning for considering only attack scenarios that would cause minimal damage to a spent fuel storage cask. Whatever the Staff's reasoning may have been, its failure to consider credible attacks with significant adverse impacts violates NEPA.

13

uninhabitable of about 7,500 square kilometers of land, together with cancers and other adverse health effects and significant economic and social damage. Id. at 17, 37.

The NRC Staff violated NEPA by failing to prepare a full-scale EIS that analyzed the impacts of a wide range of potential attack scenarios, including the attack scenarios described above and in Dr. Thompson's Report at pages 34-36.6 The EIS should include a publicly available version that summarizes the nature of the scenarios considered and their impacts, and it should also include a detailed description whose circulation is restricted to agencies, groups and individuals that have a demonstrated interest in the information and are cleared to receive such information.

Contention 4: Failure to address National Infrastructure Protection Plan (NIPP)

The EA fails to comply with NEPA and NRC implementing regulations because it fails to address homeland-security strategy, the principles of protective deterrence, or the opportunities that the NIPP has identified for incorporating protective features into the design of infrastructure elements.

Basis: The U.S. Department of Homeland Security has issued the National Infrastructure Protection Plan ("NIPP"), whose purpose is to provide "the unifying structure for the integration of critical infrastructure and key resources (Cl/KR) protection into a single national program." Id. at vii. The NIPP identifies three purposes of measures to protect critical infrastructure and key resources: (i) deter the threat; (ii) mitigate vulnerabilities; and (iii) minimize consequences associated with an attack or 6 It is not SLOMFP's responsibility to identify all credible scenarios that should be evaluated in an EIS. That is the NRC's responsibility.

14

other incident. Id. at 7. The NIPP identifies a range of protective measures to achieve these purposes:

Protection can include a wide range of activities such as improving business protocols, hardening facilities, buildingresiliency and redundancy, incorporating hazard resistance into initial facility design, initiating active or passive countermeasures, installing security systems, leveraging 'self-healing' technologies, promoting workforce surety programs, or implementing cyber security measures, among various others.

Id. at 7. Protective measures of these types could significantly reduce the conditional probability that an attack would be successful. Thompson Report at 11-12. Such measures could, therefore, "deter" attacks by altering attackers' cost-benefit calculations.

As Dr. Thompson observes in his report, that form of deterrence is different from deterrence attributable to an attacked party's capability to counter-attack. Id.

As a signatory to the Department of Homeland Security's National Infrastructure Protection Plan, the NRC is responsible for demonstrating that its environmental analysis of the impacts of attacks on the Diablo Canyon ISFSI is consistent with the NIPP. Yet, the EA does not identify the NIPP or its officials as resources or individuals consulted under 10 C.F.R. § 51.30(a)(2).

Contention 5: Failure to consider vulnerability of ISFSI in relation to the entire Diablo Canyon spent fuel storage complex.

The EA fails to comply with NEPA because it does not consider the significant cumulative impacts of the proposed ISFSI in relation to the impacts of the existing high-density pool storage system for spent fuel at the Diablo Canyon nuclear plant. The NRC Staff should prepare an EIS that discusses the cumulative impacts of spent fuel storage at the Diablo Canyon site, including the vulnerability of both the ISFSI and the spent fuel 15

storage pools to attack. The EIS should also consider alternatives for mitigating those impacts, such as using the ISFSI to reduce the density of fuel storage in the pool.

Basis: According to the 2003 EA, the proposed ISFSI is neede.d to provide additional spent fuel storage capacity for the Diablo Canyon plant, in order to allow the plant to continue to operate after the spent fuel pool becomes filled to capacity. The ISFSI will provide storage capacity "as needed" during the operating life of the plant and will be able to hold the entire inventory of spent fuel after the plant closes. Id. at 2.

As discussed in Dr. Thompson's Report at page 17, a conventional accident or attack on a Diablo Canyon spent fuel pool that causes the water level in the pool to fall below the top of the fuel-storage racks would cause a large atmospheric release of the cesium-137 in the pool (50 percent being a likely release fraction), causing widespread land contamination and adverse health and economic effects.

As the Commission has held, NEPA requires an EIS to consider the cumulative impacts of a proposed action, i.e., the incremental impacts of the proposed action when added to the impacts of past, present, and reasonably foreseeable actions. Hydro Resources, Inc., CLI-01-04, 53 NRC 31, 60 (2001). The NRC Staff should prepare an EIS that considers the cumulative impact of the proposed ISFSI in relation to the significant existing environmental risks posed by the Diablo Canyon spent fuel storage pools. The EIS should also examine, as a mitigative measure, the use of the ISFSI to reduce the risk of a pool fire by lowering the density of fuel assemblies in the Diablo Canyon spent fuel storage pools.

16

III. SLOMFP'S CONTENTIONS SATISFY THE NRC'S LATE-FILED CONTENTION CRITERIA.

The contentions in Section II above satisfy a balancing of the NRC's late-filed contention criteria in 10 C.F.R. § 2.714(a). First, SLOMFP satisfies the first and most important factor -- good cause -- because it is filing its contentions within 30 days of the issuance, of the EA Supplement. The EA Supplement constitutes the first attempt by the NRC to address the environmental impacts of intentional attacks on the Diablo Canyon spent fuel storage facility, and therefore this is the first opportunity SLOMFP has had to address the adequacy of the analysis.

Second, SLOMFP has no means other than this proceeding to vindicate its interest in requiring the NRC to fully comply with NEPA in considering the environmental 7

impacts of intentional attacks on the Diablo Canyon ISFSI.

Third, SLOMFP's participation may reasonably be expected to assist in the development of a sound record. SLOMFP is assisted by experienced counsel and Dr.

Gordon Thompson, a qualified expert on risk assessment and nuclear security issues who has prepared an expert report regarding the deficiencies of the EA Supplement and who is prepared to testify regarding those deficiencies. If and when the NRC Staff complies with NEPA by identifying the sources on which it relied for the EA Supplement, SLOMFP also anticipates that it will retain Dr. Edwin S. Lyman of the Union of Concerned Scientists, for the purpose of reviewing any documents that may be protected as classified or safeguards information. Dr. Lyman's expert qualifications regarding nuclear facility security issues were established in Duke Energy Corporation(Catawba 7 While SLOMFP may submit comments on the EA Supplement, the NRC's failure to respond to its comments does not appear to be appealable in federal court unless SLOMFP has also requested a hearing.

17

Nuclear Station, Units 1 and 2), LBP-04-13, 60 NRC 33, affirmed, CLI-04-21, 60 NRC 21 (2004). Dr. Lyman recently applied for and received renewal of his Level L security clearance, for the purpose of reviewing any relevant classified documents that may be identified in this case.

Finally, SLOMFP anticipates that its participation in this proceeding will broaden and delay the proceeding. Nevertheless, it is not appropriate for the Commission to give any weight to this factor, because SLOMFP has done nothing to cause any delay or 1 1 th hour broadening of the proceeding. SLOMFP has sought compliance by the NRC with NEPA's requirement to consider the environmental impacts of attacks on the Diablo Canyon ISFSI since the proceeding began over five years ago. Any delay is attributable to the intransigence of the NRC and PG&E, not to SLOMFP.

IV. CONCLUSION For the foregoing reasons, SLOMFP requests the Commission to admit its contentions and hold a formal adjudicatory hearing on the adequacy of the EA Supplement to consider the environmental impacts of intentional attacks on the proposed Diablo Canyon ISFSI.

Respectfully submitted, Diane Curran Harmon, Curran, Spielberg & Eisenberg, LLP 1726 M Street N.W., Suite 600 Washington, DC 20036 202/328-3500 FAX: 202/328-6918 e-mail: dcurran(harmoncurran.com June 28, 2007 (corrected June 29, 2007) 18

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of:

PACIFIC GAS & ELECTRIC CO.  : Docket No. 72 ISFSI (Diablo Canyon Nuclear Power Plant Unit Nos. 1 and 2)

DECLARATION OF DR. GORDON R. THOMPSON IN SUPPORT OF SAN LUIS OBISPO MOTHERS FOR PEACE'S (SLOMFP's)

CONTENTIONS REGARDING THE DIABLO CANYON ENVIRONMENTAL ASSESSEMENT SUPPLEMENT Under penalty of perjury, I, Gordon R. Thompson, declare as follows:

1. I am the executive director of the Institute for Resource and Security Studies (IRSS), a nonprofit, tax-exempt corporation based in Massachusetts. Our office is located at 27 Ellsworth Avenue, Cambridge, MA 02139. IRSS was founded in 1984 to conduct technical and policy analysis and public education, with the objective of promoting peace and international security, efficient use of natural resources, and protection of the environment. I am an expert in the technical analysis of safety, security and environmental issues related to nuclear facilities. A copy of my curriculum vitae is attached.

2. I received an undergraduate education in science and mechanical engineering at the University of New South Wales, in Australia. Subsequently, I pursued graduate studies at Oxford University and received from that institution a Doctorate of Philosophy in mathematics in 1973, for analyses of plasmas undergoing thermonuclear fusion. During my graduate studies I was associated with the fusion research program of the UK Atomic Energy Authority. My undergraduate and graduate work provided me with a rigorous education in the methodologies and disciplines of science, mathematics, and engineering.

3. Since 1977, a significant part of my work has consisted of technical analyses of safety, security and environmental issues related to nuclear facilities. These analyses have been sponsored by a variety of nongovernmental organizations and local, state and national governments, predominantly in North America and Western Europe. Drawing upon these analyses, I have provided expert testimony in legal and regulatory proceedings, and have served on committees advising US government agencies. To illustrate my expertise, I provide in the following paragraphs some details of my experience.

2

4. I have conducted, directed, and/or participated in a number of studies that evaluated aspects of the design and operation of nuclear facilities with respect to severe accident probabilities and consequences. These ihclude generic studies and studies of individual facilities. For instance, with respect to generic studies on the potential for severe accidents at nuclear power plants, I was co-investigator in a study by the Union of Concerned Scientists on the 'source term" issue -- the potential for release of radioactive material to the environment.' Also, I was one of a team of four scientists who prepared, for Greenpeace International, a comprehensive critique of the state of the art of probabilistic risk assessment (PRA) for nuclear power plants.2 Our report noted that acts of malice, such as sabotage and acts of war, are not considered in PRAs, despite a history of malicious acts at many nuclear facilities. In addition, I conducted analysis on the relevance of PRA to emergency response planning, as part of a study on emergency planning for nuclear power plant accidents.3 All of these studies required me to be highly familiar with the design and operation of nuclear power plants, as well as the characteristics of probabilistic risk assessment.

5. I have also done considerable work on the risks posed by individual nuclear facilities.

In addition to performing the studies described elsewhere in this declaration, I have studied the risks posed by the Seabrook, Pilgrim, Vermont Yankee and Three Mile Island plants (USA), the Darlington and Pickering stations (Canada), the Sizewell B station (UK) and the Dukovany plant (Czech Republic). All of these studies required me to become familiar with the relevant details of the design and operation of the facilities involved.

6. To a significant degree, my work has been accepted or adopted by relevant governmental agencies. During the period 1978-1979, for example, I served on an international review group commissioned by the government of Lower Saxony (a state in Germany) to evaluate a proposal for a nuclear fuel cycle center at Gorleben. I led the subgroup that examined accident risks and identified alternative options with lower risk.4 One of the risk issues that I identified and analyzed was the potential for self-sustaining, Steven Sholly and Gordon Thompson, The Source Term Debate (Cambridge, Massachusetts: Union of Concerned Scientists, January 1986).

2 H Hirsch et al, IAEA Safety Targets and Probabilistic Risk Assessment (Hannover, Germany:

Gesellschaft fur Okologische Forschung und Beratung mbH, August 1989).

3 D Golding et al, Preparing for Nuclear Power Plant Accidents (Boulder, Colorado: Westview Press, 1995).

4 Jan Beyea, Yves Lenoir, Gene Rochlin and Gordon Thompson (subgroup chair), Report of the Gorleben International Review, Chapter 3: Potential Accidents and their Effects, submitted (in German) to the Government of Lower Saxony, March 1979.

3 exothermic oxidation reactions of fuel cladding in a high-density spent fuel pool if water is lost from the pool. Hereafter, for simplicity, this event is referred to as a "pool fire".

In examining the potential for a pool fire, I identified partial loss of water as a more severe condition than total loss of water. I identified a variety of events that could cause a loss of water from a pool, including aircraft crash, sabotage, terrorism and acts of war.

Also, I identified and described alternative fuel storage options with lower risk; these lower-risk options included design features such as spatial separation, natural cooling and underground vaults. The Lower Saxony government accepted my findings about the risk of a pool fire, and ruled in May 1979 that high-density pool storage of spent fuel was not an acceptable option at Gorleben. As a direct result, policy throughout Germany has been to use dry storage in casks, rather than high-density pool storage, for away-from-reactor storage of spent fuel.

7. My work has also influenced decision making by safety officials in the U.S.

Department of Energy (DOE). During the period 1986-1991, I was commissioned by environmental groups to assess the safety of the military production reactors at the Savannah River Site, and to identify and assess alternative options for the production of tritium for the US nuclear arsenal. Initially, much of the relevant information was classified or otherwise inaccessible to the public. Nevertheless, I addressed safety issues through analyses that were recognized as accurate by nuclear safety officials at DOE. I eventually concluded that the Savannah River reactors could not meet the safety objectives set for them by DOE.6 DOE subsequently reached the same conclusion, and scrapped the reactors. The current national policy for tritium production is to employ commercial reactors, an option that I had concluded was technically attractive but problematic from the perspective of nuclear weapons proliferation.

8. In 1977, and again during the period 1996-2000, I examined the safety of nuclear fuel reprocessing and liquid high-level radioactive waste management facilities at the Sellafield site in the UK. My investigation in the latter period was supported by consortia of local governments in Ireland and the UK, and I presented my interim findings at briefings in the UK and Irish parliaments in 1998. I identified safety issues that were not addressed in any publicly available literature about the Sellafield site.7 As a 5 At water-cooled reactors, such as those at Diablo Canyon, the fuel cladding is made from a zirconium alloy that can enter into a vigorous exothermic oxidation reaction with either air or steam. For simplicity, this reaction can be referred to as a "fire".

6 Gordon Thompson and Steven C Sholly, No Restart for K Reactor (Cambridge, Massachusetts:

Institute for Resource and Security Studies, October 1991).

7 Gordon Thompson, High Level Radioactive Liquid Waste at Sellafield: Risks, Alternative Options and Lessons for Policy (Cambridge, Massachusetts: Institute for Resource and Security Studies, June 1998).

4 direct result of my investigation, the UK Nuclear Installations Inspectorate (NII) required the operator of the Sellafield site -- British Nuclear Fuels (BNFL) -- to conduct extensive safety analyses. These analyses confirmed the significance of the safety issues that I had identified, and in January 2001 the NII established a legally binding schedule for reduction of the inventory of liquid high-level radioactive waste at Sellafield.8 The NII took this action in recognition of the grave offsite consequences of a release to the environment from the tanks in which liquid high-level waste is stored. I had identified a variety of events that could cause such a release, including acts of malice or insanity.

9. In May 2000 1 completed a study for Greenpeace International on the hazard potential of the La Hague site in France.9 Nuclear fuel reprocessing and related activities are conducted at this site. The operator of the site -- COGEMA -- was authorized to store 14,000 tonnes of spent fuel in high-density pools at La Hague, and proposed to increase the capacity of these pools to 17,600 tonnes. My study described the potential for a pool fire at La Hague, and identified events -- including acts of malice or insanity -- that could lead to a pool fire. One of the findings of my study was that neither COGEMA nor the French government had a thorough understanding of La Hague's hazard potential, including the potential for a pool fire. Subsequent to the attacks of 11 September 2001 in New York and Washington, media exposure brought La Hague's hazard potential to the attention of the French government. During October 2001 the French government deployed anti-aircraft missiles at La Hague.

10. As stated in paragraph 6, I determined in the period 1978-1979 that partial loss of water from a high-density spent fuel pool is a more severe condition than total loss of water. This is because convective heat transfer is suppressed by the presence of residual water at the base of the fuel assemblies. During any scenario for loss of water from a spent fuel pool, there will be a period of time during which residual water is present. As a result, comparatively old fuel -- potentially including fuel aged 10 or more years after discharge from a reactor -- can ignite if water is lost from a high-density spent fuel pool.

The NRC Staff failed, for more than two decades, to understand this point. An illustration of the Staffs lack of understanding was provided by its statements during a license amendment proceeding in regard to the expansion of spent fuel pool capacity at the Harris nuclear power plant. I served as an expert witness for Orange County, North Carolina, the intervenor in this proceeding. In filings during March and April 2000, the 8 Nuclear Installations Inspectorate, "Specification Issued under Licence Condition 32(4) for the Limitation of the Accumulation or Storage of Liquid High Level Radioactive Waste in B215. Licence Instrument 343. January 2001."

9 Gordon Thompson, Hazard Potential of the La Hague Site: An Initial Review (Cambridge, Massachusetts: Institute for Resource and Security Studies, May 2000).

5 Staff repeatedly disparaged my statements that comparatively old fuel can ignite. A few months later, however, the Staff adopted my position. In a report dated October 2000, but not published until January 2001, the Staff recognized that the flow of air to exposed fuel assemblies could be blocked by the presence of collapsed structures -- which might be attributable, for example, to a cask drop or an earthquake -- or by the presence of residual water. 10 The Staff analyzed the heat transfer implications of flow blockage and concluded:"

"While the February 2000 [draft] study indicated that for the cases analyzed a required decay time of 5 years would preclude a zirconium fire, the revised analyses show that it is not feasible, without numerous constraints, to define a generic decay heat level (and therefore decay time) beyond which a zirconium fire is not physically possible."

11. On numerous occasions, I have drawn attention in my writings and oral presentations to the vulnerability of nuclear facilities to acts of malice or insanity. I have pointed out that PRAs do not address acts of malice or insanity, with the result that a PRA can, at best, provide a lower bound to the probability of a release of radioactive material.12 In 1996 1wrote a generic report on war and terrorism as risk factors for nuclear power plants.13 Among other findings, this report noted that an act of war or terrorism at a nuclear power plant might have as its primary target the spent fuel stored at the plant, rather than the reactor. The report concluded with a statement that:

"Public debate about the future operation of existing nuclear power plants, and the construction of new plants, should be broadened to encompass the possible involvement of nuclear plants in war or terrorism."

12. I am familiar with the License Application, Safety Analysis Report, and Environmental Report for Pacific Gas & Electric Company's proposed Independent Fuel Storage Installation on the site of the Diablo Canyon nuclear power plant.

13. I am also familiar with the NRC's Supplement to the Environmental Assessment and Draft Finding of No Significant Impact Related to the Construction and Operation of the

'0 Timothy Collins et al (authors are all from the NRC Staff), Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants, October 2000.

" Collins et al, October 2000 (op cit), page 2-1.

12 The strengths and weaknesses of PRA methodology are discussed in Hirsch et al, August 1989 (op cit).

13 Gordon Thompson, War, Terrorism and Nuclear Power Plants (Canberra: Peace Research Centre, Australian National University, October 1996).

6 Diablo Canyon Independent Spent Fuel Storage Installation (May 29, 2007) ("Diablo EA Supplement"). I have prepared a report that includes an analysis of the deficiencies in the Diablo EA Supplement's evaluation of the environmental impacts of intentional attacks on the proposed Diablo Canyon spent fuel storage facility: Assessing Risks of Potential Malicious Actions at Commercial Nuclear Facilities: The Case of a Proposed Independent Spent Fuel Storage Installation at the Diablo Canyon Site ("Report").

14. I also assisted SLOMFP in the preparation of its contentions regarding the Diablo EA Supplement.

15. The statements of fact in SLOMFP's contentions and my Report are true and correct to the best of my knowledge, and the opinions set forth therein are based on my best professional judgment.

16. I am prepared to testify as an expert witness on behalf of SLOMFP with respect to the facts and opinions set forth in SLOMFP's contentions and my Report.

Gordon R. Thompson, D.Phil June 27, 2007,

Curriculum Vitae for Gordon R. Thompson October 2006 Professional expertise

- Technical and policy analysis in the fields of energy, environment, sustainable development, human security, and international security.

Current appointments

- Executive director, Institute for Resource & Security Studies (IRSS), Cambridge, Massachusetts (since 1984).

- Research Professor, George Perkins Marsh Institute, Clark University, Worcester, Massachusetts (since 2002).

Education

• D.Phil., applied mathematics, Oxford University (Balliol College), 1973.

• B.E., mechanical engineering, University of New South Wales, Sydney, Australia, 1967.

- B.Sc., mathematics & physics, University of New South Wales, 1966.

Project sponsors and tasks (selected)

- World Health Organization, 2006: conducted policy analysis on the potential for "health-bridge" programs to improve cooperation within and between nations.

e Attorney General of Massachusetts, 2006: conducted technical analysis and provided expert testimony regarding risks of storing spent fuel at nuclear power plants.

• Various sponsors, 2006: co-coordinated the Working Group on US-Iran Health Science Cooperation.

- Minnesota Center for Environmental Advocacy, and Minnesotans for an Energy Efficient Economy, 2005-2006: conducted technical analysis and provided expert testimony regarding management of spent fuel from the Monticello nuclear power plant.

- California Energy Commission, 2005: conducted technical analysis and participated in

• anexpert workshop regarding safety and security of commercial nuclear facilities.

- Committee on Radioactive Waste Management (a committee appointed by the UK government), 2005: provided expert advice and technical analysis on safety and security of radioactive waste management.

- Legal Resources Centre, Cape Town, South Africa, 2004-2005: conducted technical analysis regarding the proposed South African pebble bed modular nuclear reactor.

- STAR Foundation, New York, 2002-2004: reviewed planning and actions for decommissioning of research reactors at Brookhaven National Laboratory.

• Attorney General of Utah, 2003: conducted technical analysis and provided expert testimony regarding a proposed national storage facility for spent nuclear fuel.

Curriculum Vitaefor Gordon R. Thompson October 2006 Page 2

• Mothers for Peace, California, 2002-2004: analyzed risk issues and prepared expert testimony associated with the Diablo Canyon nuclear power plant.

• Citizens Awareness Network, Massachusetts, 2002-2003: conducted analysis on robust storage of spent nuclear fuel.

• Tides Center, California, 2002-2004: conducted analysis for the Santa Susana Field Laboratory (SSFL) Advisory Panel regarding the history of releases of radioactive material from the SSFL.

- Orange County, North Carolina, 1999-2002: assessed risk issues associated with the Harris nuclear power plant, identified risk-reduction options, and prepared expert testimony.

- William and Flora Hewlett Foundation and other sponsors, 1999-2006: performed research and project development for conflict-management projects, through IRSS's International Conflict Management Program.

- STAR Foundation, New York, 2000-2001: assessed risk issues associated with the Millstone nuclear power plant, identified risk-reduction options, and prepared expert testimony.

• Massachusetts Water Resources Authority, 2000: evaluated risks associated with water supply and wastewater systems that serve greater Boston.

- Canadian Senate, Energy & Environment Committee, 2000: reviewed risk issues associated with the Pickering Nuclear Generating Station.

- Greenpeace International, Amsterdam, 2000: reviewed impacts associated with the La Hague nuclear complex in France.

- Government of Ireland, 1998-2001: developed framework for assessment of impacts and alternative options associated with the Sellafield nuclear complex in the UK.

• Clark University, Worcester, Massachusetts, 1998-1999: participated in confidential review of outcomes of a major foundation's grants related to climate change.

- UN High Commissioner for Refugees, 1998: developed a strategy for conflict management in the CIS region.

- General Council of County Councils (Ireland), W. Alton Jones Foundation (USA), and Nuclear Free Local Authorities (UK), 1996-2000: assessed safety and economic issues of nuclear fuel reprocessing in the UK; assessed alternative options.

• Environmental School, Clark University, Worcester, Massachusetts, 1996: session leader at the Summer Institute, "Local Perspectives on a Global Environment".

- Greenpeace Germany, Hamburg, 1995-1996: a study on war, terrorism and nuclear power plants.

- HKH Foundation, New York, and Winston Foundation for World Peace, Washington, DC, 1994-1996: studies and workshops on preventive action and its role in US national security planning.

- Carnegie Corporation of New York, Winston Foundation for World Peace, Washington, DC, and others, 1995: collaboration with the Organization for Security and Cooperation in Europe to facilitate improved coordination of activities and exchange of knowledge in the field of conflict management.

- World Bank, 1993-1994: a study on management of data describing the performance of projects funded by the Global Environment Facility (joint project of IRSS and Clark University).

Curriculum Vitae for Gordon R. Thompson October 2006 Page 3

• International Physicians for the Prevention of Nuclear War, 1993-1994: a study on the international control of weapons-usable fissile material.

- Government of Lower Saxony, Hannover, Germany, 1993: analysis of standards for radioactive waste disposal.

- University of Vienna (using funds supplied by the Austrian government), 1992: review of radioactive waste management at the Dukovany nuclear power plant, Czech Republic.

- Sandia National Laboratories, 1992-1993: advice to the US Department of Energy's Office of Foreign Intelligence.

• US Department of Energy and Battelle Pacific Northwest Laboratories, 1991-1992:

advice for the Intergovernmental Panel on Climate Change regarding the design of an information system on technologies that can limit greenhouse gas emissions (joint project of IRSS, Clark University and the Center for Strategic and International Studies).

• Winston Foundation for World Peace, Boston, Massachusetts, and other funding sources, 1992-1993: development and publication of recommendations for strengthening the International Atomic Energy Agency.

- MacArthur Foundation, Chicago, Illinois, W. Alton Jones Foundation, Charlottesville, Virginia, and other funding sources, 1984-1993: policy analysis and public education on a "global approach" to arms control and disarmament.

- Energy Research Foundation, Columbia, South Carolina, and Peace Development Fund, Amherst, Massachusetts, 1988-1992: review of the US government's tritium production (for nuclear weapons) and its implications.

• Coalition of Environmental Groups, Toronto, Ontario (using funds supplied by Ontario Hydro under the direction of the Ontario government), 1990-1993: coordination and conduct of analysis and preparation of testimony on accident risk of nuclear power plants.

- Greenpeace International, Amsterdam, Netherlands, 1988-1990: review of probabilistic risk assessment for nuclear power plants.

- Bellerive Foundation, Geneva, Switzerland, 1989-1990: planning for a June 1990 colloquium on disarmament and editing of proceedings.

- Iler Research Institute, Harrow, Ontario, 1989-1990: analysis of regulatory response to boiling-water reactor accident potential.

- Winston Foundation for World Peace, Boston, Massachusetts, and other funding sources, 1988-1989: analysis of future options for NATO (joint project of IRSS and the Institute for Peace and International Security).

- Nevada Nuclear Waste Project Office, Carson City, Nevada (via Clark University),

1989-1990: analyses of risk aspects of radioactive waste management and disposal.

• Ontario Nuclear Safety Review (conducted by the Ontario government), Toronto, Ontario, 1987: review of safety aspects of CANDU reactors.

- Washington Department of Ecology, Olympia, Washington, 1987: analyses of risk aspects of a proposed radioactive waste repository at Hanford.

- Natural Resources Defense Council, Washington, DC, 1986-1987: preparation of expert testimony on hazards of the Savannah River Plant, South Carolina.

- Lakes Environmental Association, Bridgton, Maine, 1986: analysis of federal regulations for disposal of radioactive waste.

• Greenpeace Germany, Hamburg, 1986: participation in an international study on the hazards of nuclear power plants.

Curriculum Vitae for Gordon R. Thompson October 2006 Page 4

- Three Mile Island Public Health Fund, Philadelphia, Pennsylvania, 1983-1989: studies related to the Three Mile Island nuclear power plant and emergency response planning.

- Attorney General, Commonwealth of Massachusetts, 1984-1989: analyses of the safety of the Seabrook nuclear power plant, preparation of expert testimony.

- Union of Concerned Scientists, Cambridge, Massachusetts, 1980-1985: studies on energy demand and supply, nuclear arms control, and the safety of nuclear installations.

• Conservation Law Foundation of New England, Boston, Massachusetts, 1985:

preparation of expert testimony on cogeneration potential at a Maine paper mill.

• Town & Country Planning Association, London, UK, 1982-1984: coordination and conduct of a study on safety and radioactive waste implications of the proposed Sizewell nuclear power plant, testimony to the Sizewell Public Inquiry.

- US Environmental Protection Agency, Washington, DC, 1980-1981: assessment of the cleanup of Three Mile Island Unit 2 nuclear power plant.

• Center for Energy & Environmental Studies, Princeton University, Princeton, New Jersey, and Solar Energy Research Institute, Golden, Colorado, 1979-1980: studies on the potentials of renewable energy sources.

• Government of Lower Saxony, Hannover, Federal Republic of Germany, 1978-1979:

coordination and conduct of studies on safety and security aspects of the proposed Gorleben nuclear fuel cycle center.

Other experience (selected)

• Principal investigator, project on "Exploring the Role of'Sustainable Cities' in Preventing Climate Disruption", involving IRSS and three other organizations, 1990-1991.

" Visiting fellow, Peace Research Centre, Australian National University, 1989.

" Principal investigator, Three Mile Island emergency planning study, involving IRSS, Clark University and other partners, 1987-1989.

• Co-leadership (with Paul Walker) of a study group on nuclear weapons proliferation, Institute of Politics, Harvard University, 1981.

• Foundation (with others) of an ecological political movement in Oxford, UK, which contested the 1979 Parliamentary election.

• Conduct of cross-examination and presentation of expert testimony, on behalf of the Political Ecology Research Group, at the 1977 Public Inquiry into proposed expansion of reprocessing capacity at Windscale, UK.

• Conduct of research on plasma theory (while a D.Phil candidate), as an associate staff member, Culham Laboratory, UK Atomic Energy Authority, 1969-1973.

• Service as a design engineer on coal-fired power plants, New South Wales Electricity Commission, Sydney, Australia, 1968.

Publications (selected)

• "Using Psychosocial Healing in Postconflict Reconstruction" (with Paula Gutlove), in Mari Fitzduff and Chris E. Stout (eds), The Psychology of Resolving Global Conflicts:

From War to Peace, Praeger Security International, 2006.

Curriculum Vitae for Gordon R. Thompson October 2006 Page 5

• "What Role for Nuclear Power in a Sustainable Civilization?", The Green Cross Optimist, Spring 2006, pp 28-30.

- RadiologicalRisk of HomeportBasing of a Nuclear-PropelledAircraft Carrierin Yokosuka, Japan,a report for the Citizens Coalition Concerning the Homeporting of a CVN in Yokosuka, 29 June 2006.

- Risks and Risk-Reducing Options Associated with Pool Storage of Spent Nuclear Fuel at the Pilgrim and Vermont Yankee Nuclear Power Plants,a report for the Attorney General, Commonwealth of Massachusetts, 25 May 2006.

- Reasonably ForeseeableSecurity Events: Potentialthreats to options for long-term management of UK radioactivewaste, a report for the UK Committee on Radioactive Waste Management, 2 November 2005.

- "Plasma, policy and progress", The AustralianMathematical Society Gazette, Volume 32, Number 3, 2005, pp 162-168.

- "A Psychosocial-Healing Approach to Post-Conflict Reconstruction" (with Paula Gutlove), Mind & Human Interaction,Volume 14, Number 1, 2005, pp 35-63.

- "Designing Infrastructure for New Goals and Constraints", Proceedings of the conference, Working Together. R&D Partnershipsin Homeland Security, Boston, Massachusetts, 27-28 April 2005, sponsored by the US Department of Homeland Security. (A version of this paper has also been published as CRS Discussion Paper 2005-02, Center for Risk and Security, George Perkins Marsh Institute, Clark University, Worcester, Massachusetts.)

- "Potential Radioactive Releases from Commercial Reactors and Spent Fuel",

Proceedings of the conference, Working Together: R&D Partnershipsin Homeland Security, Boston, Massachusetts, 27-28 April 2005, sponsored by the US Department of Homeland Security. (A version of this paper has also been published as CRS Discussion Paper 2005-03, Center for Risk and Security, George Perkins Marsh Institute, Clark

.University, Worcester, Massachusetts.)

• Safety of the ProposedSouth African PebbleBed Modular Reactor, a report for the Legal Resources Centre, Cape Town, South Africa, 12 January 2005.

- Decommissioningof Research Reactors at Brookhaven NationalLaboratory:Status, Future Options andHazards, a report for STAR Foundation, East Hampton, New York, April 2004.

• "Psychosocial Healing and Post-Conflict Social reconstruction in the Former Yugoslavia" (with Paula Gutlove), Medicine, Conflict and Survival, Volume 20, Number 2, April-June 2004, pp 136-150.

- "Reducing the Hazards from Stored Spent Power-Reactor Fuel in the United States" (with Robert Alvarez, Jan Beyea, Klaus Janberg, Jungmin Kang, Ed Lyman, Allison Macfarlane and Frank N. von Hippel), Science and Global Security, Volume 11, 2003, pp 1-51.

• "Health, Human Security, and Social Reconstruction in Afghanistan" (with Paula Gutlove and Jacob Hale Russell), in John D. Montgomery and Dennis A. Rondinelli (eds), Beyond Reconstruction in Afghanistan, Palgrave Macmillan, 2004.

• PsychosocialHealing: A Guidefor Practitioners,based on programsof the Medical Networkfor Social Reconstruction in the Former Yugoslavia (with Paula Gutlove), IRSS, Cambridge, Massachusetts and OMEGA Health Care Center, Graz, Austria, May 2003.

Curriculum Vitae for Gordon R. Thompson October 2006 Page 6

• A CallforAction to Protect the Nation Against Enemy Attack on Nuclear Power Plants and Spent Fuel, and a Supporting Document, Mothers for Peace, San Luis Obispo, California, April 2003 and May 2003.

• "Human Security: Expanding the Scope of Public Health" (with Paula Gutlove),

Medicine, Conflict and Survival, Volume 19, 2003, pp 17-34.

- Social Reconstruction in Afghanistan through the Lens of Health andHuman Security (with Paula Gutlove and Jacob Hale Russell), IRSS, Cambridge, Massachusetts, May 2003.

• Robust Storage of Spent Nuclear Fuel. A Neglected Issue of Homeland Security, a report for Citizens Awareness Network, Shelburne Falls, Massachusetts, January 2003.

- Medical Network for Social Reconstruction in the Former Yugoslavia: A Survey of Participants'Views on the Network's Goals andAchievements, IRS S, Cambridge, Massachusetts, September 2001.

- The Potentialfor a Large,Atmospheric Release of Radioactive Materialfrom Spent Fuel Pools at the HarrisNuclear Power Plant: The Case of a Pool Release Initiatedby a Severe Reactor Accident, a report for Orange County, North Carolina, 20 November 2000.

- A Review of the Accident Risk Posed by the Pickering 'A'Nuclear GeneratingStation, a report for the Standing Committee on Energy, Environment and Natural Resources, Canadian Senate, August 2000.

- High-Level RadioactiveLiquid Waste at Sellafield."An UpdatedReview, a report for the UK Nuclear Free Local Authorities, June 2000.

- HazardPotentialof the La Hague Site: An InitialReview, a report for Greenpeace International, May 2000.

- A Strategyfor Conflict Management: IntegratedAction in Theory and Practice(with Paula Gutlove), IRSS, Cambridge, Massachusetts, March 1999.

• Risks and Alternative Options Associated with Spent Fuel Storage at the Shearon HarrisNuclear Power Plant, a report for Orange County, North Carolina, February 1999.

- High Level Radioactive Liquid Waste at Sellafield: Risks, Alternative Options and Lessons for Policy, IRSS, Cambridge, Massachusetts, June 1998.

- "Science, democracy and safety: why public accountability matters", in F. Barker (ed),

Management of Radioactive Wastes: Issues for local authorities,Thomas Telford, London, 1998.

• "Conflict Management and the OSCE" (with Paula Gutlove), OSCE/ODIHR Bulletin, Volume 5, Number 3, Fall 1997.

- Safety of the Storage ofLiquidHigh-Level Waste at Sellafield (with Peter Taylor),

Nuclear Free Local Authorities, UK, November 1996.

- Assembling Evidence on the Effectiveness ofPreventive Actions, their Benefits, and their Costs: A Guidefor Preparationof Evidence, IRSS, Cambridge, Massachusetts, August 1996.

- War, Terrorism and NuclearPower Plants, Peace Research Centre, Australian National University, Canberra, October 1996.

- "The Potential for Cooperation by the OSCE and Non-Governmental Actors on Conflict Management" (with Paula Gutlove), Helsinki Monitor, Volume 6 (1995), Number 3.

Curriculum Vitae for Gordon R. Thompson October 2006 Page 7 "Potential Characteristics of Severe Reactor Accidents at Nuclear Plants", "Monitoring and Modelling Atmospheric Dispersion of Radioactivity Following a Reactor Accident" (with Richard Sclove, Ulrike Fink and Peter Taylor), "Safety Status of Nuclear Reactors and Classification of Emergency Action Levels", and "The Use of Probabilistic Risk Assessment in Emergency Response Planning for Nuclear Power Plant Accidents" (with Robert Goble), in D. Golding, J. X. Kasperson and R. E. Kasperson (eds), Preparingfor Nuclear Power Plant Accidents, Westview Press, Boulder, Colorado, 1995.

- A Data Managerfor the GlobalEnvironment Facility (with Robert Goble),

Environment Department, The World Bank, June 1994.

- Preventive Diplomacy and National Security (with Paula Gutlove), Winston Foundation for World Peace, Washington, DC, May 1994.

• Opportunitiesfor InternationalControl of Weapons- Usable Fissile Material, International Physicians for the Prevention of Nuclear War, Cambridge, Massachusetts, January 1994.

- "Article III and IAEA Safeguards", in F. Barnaby and P. Ingram (eds), Strengthening the Non-ProliferationRegime, Oxford Research Group, Oxford, UK, December 1993.

- Risk Implications of PotentialNew Nuclear Plants in Ontario (prepared with the help of eight consultants), a report for the Coalition of Environmental Groups, Toronto, submitted to the Ontario Environmental Assessment Board, November 1992 (3 volumes).

• Strengthening the InternationalAtomic Energy Agency, IRSS, Cambridge, Massachusetts, September 1992.

. Design of an Information System on Technologies that can Limit Greenhouse Gas Emissions (with Robert Goble and F. Scott Bush), Center for Strategic and International Studies, Washington, DC, May 1992.

- ManagingNuclear Accidents: A Model Emergency Response Planfor Power Plants and Communities (with six other authors), Westview Press, Boulder, CO, 1992.

- "Let's X-out the K" (with Steven C. Sholly), Bulletin of the Atomic Scientists, March 1992, pp 14-15.

- "A Worldwide Programme for Controlling Fissile Material", and "A Global Strategy for Nuclear Arms Control", in F. Barnaby (ed), Plutonium and Security, Macmillan Press, UK, 1992.

- No Restartfor K Reactor (with Steven C. Sholly), IRS S, Cambridge, Massachusetts, October 1991.

- Regulatory Response to the Potentialfor Reactor Accidents: The Example of Boiling-Water Reactors, IRSS, Cambridge, Massachusetts, February 1991.

• Peace by Piece: New Optionsfor InternationalArms Control andDisarmament, IRSS, Cambridge, Massachusetts, January 1991.

• Developing PracticalMeasures to Prevent Climate Disruption (with Robert Goble),

CENTED Research Report No. 6, Clark University, Worcester, Massachusetts, August 1990.

" "Treaty a Useful Relic", Bulletin of the Atomic Scientists, July/August 1990, pp 32-33.

• "Practical Steps for the 1990s", in Sadruddin Aga Khan (ed), Non-Proliferationin a Disarming World, Proceedings of the Groupe de Bellerive's 6th International Colloquium, Bellerive Foundation, Geneva, Switzerland, 1990.

Curriculum Vitaefor Gordon R. Thompson October 2006 Page 8

• A Global Approach to ControllingNuclear Weapons, IRS S, Cambridge, Massachusetts, October 1989.

- IAEA Safety Targets and ProbabilisticRisk Assessment (with three other authors),

Greenpeace International, Amsterdam, August 1989.

- New Directionsfor NATO (with Paul Walker and Pam Solo), published jointly by IRSS and the Institute for Peace and International Security (both of Cambridge, Massachusetts), December 1988.

- "Verifying a Halt to the Nuclear Arms Race", in F. Bamaby (ed), A Handbook of VerificationProcedures,Macmillan Press, UK, 1990.

- "Verification of a Cutoff in the Production of Fissile Material", in F.Barnaby (ed), A Handbook of Verification Procedures,Macmillan Press, UK, 1990.

- "Severe Accident Potential of CANDU Reactors," Consultant's Report in The Safety of Ontario'sNuclear Power Reactors, Ontario Nuclear Safety Review, Toronto, February 1988.

"Nuclear-FreeZones (edited with David Pitt), Croom Helm Ltd, Beckenham, UK, 1987.

"Risk Assessment Review For the Socioeconomic Impact Assessment of the Proposed High-Level Nuclear Waste Repository at Hanford Site, Washington (edited; written with five other authors), prepared for the Washington Department of Ecology, December 1987.

- The Nuclear Freeze Revisited (with Andrew Haines), Nuclear Freeze and Arms Control Research Project, Bristol, UK, November 1986. Variants of the same paper have appeared as Working Paper No. 18, Peace Research Centre, Australian National University, Canberra, February 1987, and in ADIU Report, University of Sussex, Brighton, UK, Jan/Feb 1987, pp 6-9.

• InternationalNuclear Reactor HazardStudy (with fifteen other authors), Greenpeace, Hamburg, Federal Republic of Germany (2 volumes), September 1986.

- "What happened at Reactor Four" (the Chernobyl reactor accident), Bulletin of the Atomic Scientists, August/September 1986, pp 26-31.

• The Source Term Debate: A Report by the Union of ConcernedScientists (with Steven C. Sholly), Union of Concerned Scientists, Cambridge, Massachusetts, January 1986.

- "Checks on the spread" (a review of three books on nuclear proliferation), Nature, 14 November 1985, pp 127-128.

- Editing of Perspectives on Proliferation,August 1985, published by the Proliferation Reform Project, IRSS.

• "A Turning Point for the NPT ?", ADIUReport, University of Sussex, Brighton, UK, Nov/Dec 1984, pp 1-4.

• "Energy Economics", in J. Dennis (ed), The Nuclear Almanac, Addison-Wesley, Reading, Massachusetts, 1984.

• "The Genesis of Nuclear Power", in J. Tirman (ed), The Militarizationof High Technology, Ballinger, Cambridge, Massachusetts, 1984.

- A Second Chance:New Hampshire's Electricity Future as a Model for the Nation (with Linzee Weld), Union of Concerned Scientists, Cambridge, Massachusetts, 1983.

- Safety and Waste ManagementImplications of the Sizewell PWR (prepared with the help of six consultants), a report to the Town & Country Planning Association, London, UK, 1983.

Curriculum Vitae for Gordon R. Thompson October 2006 Page 9

• Utility-Scale ElectricalStorage in the USA: The Prospectsof PumpedHydro, CompressedAir, and Batteries, Princeton University report PU/CEES #1120,1981.

- The Prospectsfor Wind and Wave Power in North America, Princeton University report PU/CEES # 117, 1981.

- HydroelectricPower in the USA: Evolving to Meet New Needs, Princeton University report PU/CEES # 115, 1981.

- Editing and part authorship of "Potential Accidents & Their Effects", Chapter III of Report of the Gorleben InternationalReview, published in German by the Government of Lower Saxony, FRG, 1979; Chapter III published in English by the Political Ecology Research Group, Oxford, UK.

- A Study of the Consequences to the Public of a Severe Accident at a CommercialFBR located at Kalkar, West Germany, Political Ecology Research Group, 1978.

Expert presentations and testimony (selected)

- Minnesota Public Utilities Commission, 2006: testimony regarding trends, risks and costs associated with management of spent fuel from the Monticello nuclear power plant.

• Presentation, "Are Nuclear Installations Terrorist Targets?", at the conference, Nuclear Energy: Does it Have a Future?,Drogheda, County Louth, Ireland, 10-11 March 2005.

• Presentation at the session, "UN Security Council Resolution 1244 and Final Status for Kosovo", at the conference, Lessons Learnedfrom the Balkan Conflicts, Boston College, Chestnut Hill, Massachusetts, 16-17 October 2004.

- California Public Utilities Commission, 2004: testimony regarding the nature and cost of potential measures for enhanced defense of the Diablo Canyonnuclear power plant.

• European Parliament, 2003: invited presentation to EP members regarding safety and security issues at the Sellafield nuclear site in the UK, and broader implications.

• US Congress, 2002 and 2003: invited presentations at member-sponsored staff briefings on vulnerabilities of nuclear-power facilities to attack and options for improved defenses.

- Numerous public forums in the USA, 2001-2006: invited presentations to public officials and general audiences regarding vulnerabilities of nuclear-power facilities to attack and options for improved defenses.

- UK Consensus Conference on Radioactive Waste Management, 1999: invited testimony on information and decision-making.

- Joint Committee on Public Enterprise and Transport, Irish Parliament, 1999: invited testimony on nuclear fuel reprocessing and international security.

- UK and Irish Parliaments, 1998: invited presentations to memberson risks and alternative options associated with nuclear fuel reprocessing in the UK.

• Center for Russian Environmental Policy, Moscow, 1996: invited presentation at a forum in parallel with the G-7 Nuclear Safety Summit.

• Lacey Township Zoning Board, New Jersey, 1995: testimony regarding radioactive waste management.

- Ontario Court of Justice, Toronto, Ontario, 1993: testimony regarding Canada's Nuclear Liability Act.

- Oxford Research Group, seminar on "The Plutonium Legacy", Rhodes House, Oxford, UK, 1993: invited presentation on nuclear safeguards.

Curriculum Vitae for Gordon R. Thompson October 2006 Page 10

• Defense Nuclear Facilities Safety Board, Washington, DC, 1991: testimony regarding the proposed restart of K-reactor, Savannah River Site.

- Conference to consider amending the Partial Test Ban Treaty, United Nations, New York, 1991: presentation on a global approach to arms control and disarmament.

• US Department of Energy, hearing on draft EIS for new production reactor capacity, Columbia, South Carolina, 1991: testimony on tritium need and implications of tritium production options.

• Society for Risk Analysis, 1990 annual meeting, New Orleans, special session on nuclear emergency planning: presentation on real-time techniques for anticipating emergencies.

.0Parliamentarians' Global Action, 11 th Annual Parliamentary Forum, United Nations, Geneva, 1990: invited presentation on the potential for multilateral nuclear arms control.

- Advisory Committee on Nuclear Facility Safety, Washington, DC, 1989: testimony on public access to information and on government accountability.

- Peace Research Centre, Australian National University, seminar on "Australia and the Fourth NPT Review Conference", Canberra, 1989: invited presentation regarding a universal nuclear weapons non-proliferation regime.

- Carnegie Endowment for International Peace, Conference on "Nuclear Non-Proliferation and the Role of Private Organizations", Washington, DC, 1989: invited presentation on options for reform of the non-proliferation regime.

• US Department of Energy, EIS scoping hearing, Columbia, South Carolina, 1988:

testimony on appropriate scope of an EIS for new production reactor capacity.

- International Physicians for the Prevention of Nuclear War, 6th and 7th Annual Congresses, Koln, FRG, 1986 and Moscow, USSR, 1987: invited presentations on relationships between nuclear power and the threat of nuclear war.

- County Council, Richland County, South Carolina, 1987: testimony on implications of severe reactor accidents at the Savannah River Plant.

• Maine Land Use Regulation Commission, 1985: testimony on cogeneration potential at facilities of Great Northern Paper Company.

• Interfaith Hearings on Nuclear Issues, Toronto, Ontario, 1984: invited presentations on options for Canada's nuclear trade and Canada's involvement in nuclear arms control.

- Sizewell Public Inquiry, UK, 1984: testimony on safety and radioactive waste implications of the proposed Sizewell nuclear power plant.

- New Hampshire Public Utilities Commission, 1983: testimony on electricity demand and supply options for New Hampshire.

• Atomic Safety & Licensing Board, US Nuclear Regulatory Commission, 1983:

testimony on use of filtered venting at the Indian Point nuclear power plant.

- US National Advisory Committee on Oceans and Atmosphere, 1982: testimony on implications of ocean disposal of radioactive waste.

- Environmental & Energy Study Conference, US Congress, 1982: invited presentation on implications of radioactive waste management.

Curriculum Vitae for Gordon R. Thompson October 2006 Page 11 Miscellaneous

• Married, two children.

• Extensive experience in public speaking and interviews by representatives of print and electronic media.

• Author of numerous essays and letters in newspapers and magazines.

Contact information Institute for Resource and Security Studies 27 Ellsworth Avenue, Cambridge, Massachusetts 02139, USA Phone: 617-491-5177 Fax: 617-491-6904 E-mail: gthompson@irss-usa.org

INSTITUTE FOR RESOURCE AND SECURITY STUDIES 27 Ellsworth Avenue, Cambridge, Massachusetts 02139, USA Phone: 617-491-5177 Fax: 617-491-6904 Email: info@irss-usa.org ASSESSING RISKS OF POTENTIAL MALICIOUS ACTIONS AT COMMERCIAL NUCLEAR FACILITIES:

The Case of a Proposed Independent Spent Fuel Storage Installation at the Diablo Canyon Site by by Gordon R. Thompson 27 June 2007 A report for San Luis Obispo Mothers for Peace California Abstract This report discusses the risks of potential malicious actions at commercial nuclear facilities in the US, with a focus on actions by sub-national groups. These risks are first discussed generically, with a focus on power reactors, their spent fuel pools, and independent spent fuel storage installations (ISFSIs) at reactor sites. The report then provides a more detailed discussion of malice-related risks at a proposed ISFSI at the Diablo Canyon site in California. In May 2007 the US Nuclear Regulatory Commission Staff issued a Supplement to its October 2003 Environmental Assessment (EA) for the Diablo Canyon ISFSI. The Supplement considered malice-related risks, pursuant to a ruling by the 9th Circuit of the US Court of Appeals that these risks should have been considered in the EA. The Supplement is reviewed here.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 2 About the Institute for Resource and Security Studies The Institute for Resource and Security Studies (IRSS) is an independent, nonprofit, Massachusetts corporation, founded in 1984. Its objective is to promote sustainable use of natural resources and global human security. In pursuit of this mission, IRSS conducts technical and policy analysis, public education, and field programs. IRSS projects always reflect a concern for practical solutions to resource and security problems.

About the Author Gordon R. Thompson is the executive director of IRSS and a research professor at Clark University, Worcester, Massachusetts. He studied and practiced engineering in Australia, and received a doctorate in applied mathematics from Oxford University in 1973, for analyses of plasma undergoing thermonuclear fusion. Dr. Thompson has been based in the USA since 1979. His professional interests encompass a range of technical and policy issues related to global human security and sustainable use of natural resources. He has conducted numerous studies on the environmental impacts of nuclear facilities, and on options for reducing these impacts.

Acknowledgements This report was prepared by IRSS for San Luis Obispo Mothers for Peace. The author, Gordon R. Thompson, is solely responsible for the content of the report.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities.

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 3 Contents

1. Introduction

2. A US-Wide Perspective on Potential Malicious Actions at Nuclear Facilities 2.1 The General Threat Environment 2.2 National Policy and Practice on Homeland Security 2.3 Commercial Nuclear Facilities as Potential Targets of Attack 2.4 The NRC's Approach to Nuclear-Facility Security

3. An Appropriate Framework for Assessing the Risks of Malicious Actions at Nuclear Facilities 3.1 Extending Traditional Risk Assessment to Encompass Malicious Actions 3.2 Examining a Full Range of Risks, Risk-Reducing Options and their Implications 3.3 Managing Sensitive Information 3.4 Ensuring Compatibility with a Comprehensive National Strategy for Homeland Security 3.5 Incorporating Findings into an Environmental Assessment or Environmental Impact Statement

4. The NRC Staffs Supplement to the Environmental Assessment for the Diablo Canyon ISFSI 4.1 Scope, Assumptions, Methodology and Conclusions of the Staffs Supplement 4.2 Threat Scenarios and Radiological Impacts Considered by the Staff 4.3 Threat Scenarios and Radiological Impacts that are Relevant to an ISFSI 4.4 Options for Reducing the Risks of Malicious Actions 4.5 An Overall Evaluation of the Staffs Supplement

5. Conclusions

6. Bibliography Tables (See next page)

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 4 List of Tables (Tables are located at the end of the report.)

Table 2-1 Public Opinion in Four Muslim Countries Regarding the US "War on Terrorism" Table 2-2 Future World Scenarios Identified by the Stockholm Environment Institute Table 2-3 Selected Approaches to Protecting US Critical Infrastructure From Attack by Sub-National Groups, and Some of the Strengths and Weaknesses of these Approaches Table 2-4 Estimated Amounts of Cesium-137 in Nuclear Fuel Associated With Diablo Canyon Unit 1 or Unit 2 Table 2-5 Illustrative Inventories of Cesium-137 Table 2-6 Some Potential Modes and Instruments of Attack on a Nuclear Power Plant Table 2-7 Potential Sabotage Events at a Spent-Fuel-Storage Pool, as Postulated in the NRC's August 1979 GEIS on Handling and Storage of Spent LWR Fuel Table 4-1 Estimated Release of Radioactive Material and Downwind Inhalation Dose for Blowdown of the MPC in a Spent Fuel Storage Module Table 4-2 The Shaped Charge as a Potential Instrument of Attack

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 5

1. Introduction A variety of nuclear facilities are deployed across the United States and worldwide to serve commercial (non-military) purposes. These facilities contain radioactive material and fissionable material that could create adverse impacts if released to the environment or used for unauthorized purposes. Those impacts could arise as a result of conventional accidents or malicious actions. Here, the term "conventional accidents" refers to incidents caused by human error, equipment failure or natural events. 1 Other incidents could be caused by deliberate, malicious actions. The parties taking 2 those malicious actions could be national governments or sub-national groups.

This report discusses the risks of potential malicious actions at commercial nuclear facilities in the US, with a focus on actions by sub-national groups. The report also focuses on a particular set of facilities that contain large amounts of radioactive material.

These facilities are reactors used for generating electrical power, and facilities at the reactor sites that store spent fuel discharged from the reactors. After discharge, spent fuel assemblies are initially stored in spent-fuel pools located adjacent to the reactors. Some years later, the assemblies could be transferred to an independent spent fuel storage installation (ISFSI) on the reactor site. ISFSIs are operating or under construction at a number of reactor sites in the US, and more are being proposed. Although this report focuses on power reactors, their spent-fuel pools, and ISFSIs at reactor sites, many of its findings are applicable to other commercial nuclear facilities.

Here, the term "risks" refers to potential adverse impacts that can be reasonably foreseen but will not necessarily occur. Such impacts can be characterized by their consequences and their probabilities of occurrence. 3 This report focuses on risks associated with potential radiological impacts arising from release to the environment of radioactive material as a result of malicious actions. Many of the report's findings are applicable to related types of risks, such as those associated with use of fissionable material for unauthorized purposes.

The DiabloEA Supplement In October 2003 the Nuclear Regulatory Commission (NRC) Staff issued an Environmental Assessment (EA) for a proposed ISFSI at the Diablo Canyon reactor site in California. The EA did not consider malice-related risks. Pursuant to a petition by

'The NRC's Glossary, accessed at the NRC web site (www.nrc.gov) on 25 June 2007, contains no definition of "accident". The term "conventional accident" is defined and used in this report to ensure precision, because the term "accident" has been used to encompass incidents caused by deliberate, malicious actions.

2 Relevant sub-national groups could be based in the US or in other countries.

3 Some analysts define "risk" as the arithmetic product of consequence and probability. That definition is simplistic and can be misleading, and is not used in this report. That definition is especially inappropriate for malice-related risks because there is usually no statistical basis to support quantitative estimates of the probabilities of malicious actions.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 6 San Luis Obispo Mothers for Peace and other parties, the 9th Circuit of the US Court of Appeals ruled in June 2006 that the EA was inadequate because it did not consider malice-related environmental impacts. In May 2007 the Staff responded to that ruling by issuing a Supplement to the October 2003 EA.4 The Supplement addresses the risks of potential malicious actions at the proposed ISFSI. Hereafter, the Supplement is described as the "Diablo EA Supplement".

Over a three-decade period, the NRC has accepted, in various contexts, that an analysis of a nuclear facility's environmental impacts, in an EA or an environmental impact statement (EIS), should consider radiological risks associated with conventional accidents. The NRC has generally refused, however, to consider malice-related risks in an EA or EIS. The Diablo EA Supplement represents a departure from that longstanding refusal. The NRC Staff has issued an analogous document in the context of an application to build and operate an industrial irradiator in Hawaii.5 Other, analogous documents are likely to be prepared in other licensing contexts. Thus, the Diablo EA Supplement deserves careful review.

This report provides a review of the Diablo EA Supplement. To support that review, the report also discusses some broader issues. The NRC has not issued any document or statement that provides an adequate discussion of the broader issues surrounding the Diablo EA Supplement.

Preparation of EAs and EISs is governed by the National Environmental Policy Act (NEPA). A major purpose of NEPA is to ensure that options for reducing the risks and other environmental impacts of a proposed action are identified and characterized. That goal is addressed repeatedly in this report.

Sensitive information Any responsible analyst who discusses potential acts of malice at nuclear facilities is careful about making statements in public settings. The author of this report exercises such care. The author has no access to classified information, and this report contains no such information. However, a higher standard of discretion is necessary. An analyst should not publish sensitive information, defined here as detailed information that could substantially assist an attacking group to attain its objectives, even if this information is publicly available from other sources. On the other hand, secrecy has costs, and an entrenched culture of secrecy is not compatible with a clear-headed, science-based approach to the understanding of risks. Section 3.3 of this report provides a further discussion about identifying and managing sensitive information.

4 NRC, 2007a.

5 NRC, 2007b.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 7 Structure of this report The remainder of this report has five sections. Section 2 provides a broad, US-wide perspective on potential malicious actions at commercial nuclear facilities. That potential is discussed within the contexts of the general threat environment and national policy on homeland security. Section 3 sets forth an appropriate framework for assessing the risks of malicious actions at nuclear facilities, and for incorporating the findings in an EA or EIS. In Section 4, the Diablo EA Supplement is reviewed, using the framework set forth in Section 3 as a standard that should be met. That review does not purport to provide analysis that corrects deficiencies in the Diablo EA Supplement. Providing such analysis is a task for the NRC Staff. Conclusions are set forth in Section 5, and a bibliography is provided in Section 6. All documents cited in the text of this report are listed in the bibliography.

2. A US-Wide Perspective on Potential Malicious Actions at Nuclear Facilities 2.1 The General Threat Environment The potential for a deliberate attack on a commercial nuclear facility arises within a larger context, namely the general threat environment for the US homeland. That environment reflects, in turn, a complex, set of factors operating internationally.

If the Diablo Canyon nuclear generation units receive 20-year license extensions, they will operate until 2041 (Unit 1) and 2045 (Unit 2), discharging spent fuel throughout that period. The proposed Yucca Mountain repository could not accommodate more than a fraction of the Diablo units' cumulative discharge of spent fuel, and it is increasingly unlikely that this repository will open. No other option is currently available for removing spent fuel from the Diablo Canyon site. At that site, as at nuclear power plant sites across the US, the most likely outcome is that spent fuel will be stored at the site for the foreseeable future, potentially for longer than a century.6 Thus, in assessing the risks of malicious actions at a Diablo Canyon ISFSI, one should consider the general threat environment over the next century.

The threatfrom sub-nationalgroups The US homeland has not been attacked by another nation since World War II. One factor behind this outcome has been the US deployment of military forces with a high capability for counter-attack. There have, however, been significant attacks on the US homeland and other US assets by sub-national groups since World War II. Such attacks are typically not deterred by US capability for counter-attack, because the attacking group has no identifiable territory. Indeed, sub-national groups may attack US assets 6 Thompson, 2005a.

Assessing Risks of PotentialMalicious Actions at Commercial Nuclear Facilities:

The Case of a ProposedlSFSI at the Diablo Canyon Site Page 8 with the specific purpose of prompting US counter-attacks that harm innocent persons, thereby undermining the global political position of the US.

Attacks on the homeland by sub-national groups in recent decades include vehicle bombings of the World Trade Center in New York in February 1993 and the Murrah Federal building in Oklahoma City in April 1995, and aircraft attacks on the World Trade Center and the Pentagon in September 2001. Outside the homeland, attacks on US assets by sub-national groups have included vehicle-bomb attacks on a Marine barracks in Beirut in October 1983 and embassies in Tanzania and Kenya in August 1998, and a boat-bomb attack on the USS Cole in October 2000. At present, sub-national groups routinely attack US forces in Iraq.

In many of these incidents, the attacking group has been based outside the US. An exception was the Oklahoma City bombing, where the attacking group was domestic in both its composition and its motives. There is concern that future attacks within the US may be made by groups that are domestically based but have linkages to, or sympathy with, interests outside the US. This phenomenon was exhibited in London in July 2005, when young men born in the UK conducted suicide bombings in underground trains and a bus.

Reducing the risks of attack by sub-national groups requires a sophisticated, multi-faceted and sustained policy. An unbalanced policy can be ineffective or counterproductive. Since September 2001, the US government has implemented a policy that is heavily weighted toward offensive military action. Evidence is accumulating that this policy has been significantly counterproductive. Table 2-1 provides a sample of the evidence. The table shows recent public-opinion data from four Muslim-majority countries (Morocco, Egypt, Pakistan, Indonesia). In each country, a majority (ranging from 53 percent of respondents in Indonesia to 86 percent in Egypt) believes that the primary goal of the US "war on terrorism" is to weaken Islam or control Middle East resources (oil and natural gas). One expression of this belief is that substantial numbers of people (ranging from 19 percent of respondents in Indonesia to 91 percent in Egypt) approve of attacks on US troops in Iraq. Smaller numbers of people 7 (ranging from 4 to 7 percent of respondents) approve of attacks on civilians in the US.

The great majority of people, in these four countries and elsewhere, will not participate in attacks on US assets. However, there are consequences when millions of people believe that the US seeks to undermine their religion and culture and control their resources.

Among other consequences, this belief creates a social climate that can help sub-national groups to form and to acquire the skills, funds and equipment they need in order to mount attacks. From a US perspective, such groups are "terrorists". Within their own cultures, they may be seen as soldiers engaged in "asymmetric warfare" with a powerful enemy.

'Kull et al, 2007.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedJSFSJ at the Diablo Canyon Site Page 9 The threat environment over the coming decades As mentioned above, an assessment of the risks of malicious actions at a Diablo Canyon ISFSI should consider the general threat environment over the next century. Forecasting trends in the threat environment over such a period is a daunting exercise, with inevitably uncertain findings. Nevertheless, if an ISFSI is constructed at Diablo Canyon, the security aspects of its design will reflect an implicit or explicit forecast of trends in the general threat environment. The forecast should be explicit, and should be global in scope, because the US cannot be insulated from broad trends in violent conflict and social disorder.

Numerous analysts - in academia, government and business - are involved in efforts to forecast possible worldwide trends that pertain to violence. These efforts rarely attempt to look forward more than one or two decades. Two examples are illustrative. First, a group based at the University of Maryland tracks a variety of indicators for most of the countries in the world, in a data base that extends back to 1950 and earlier. Using these data, the group periodically provides country-level assessments of the potential for outbreaks of violent conflict. 8 Second, the RAND corporation has conducted a literature review and assessment of potential worldwide trends that would be adverse for US 9

national security.

Several decades ago, some analysts of potential futures began taking an integrated world view, in which social and economic trends are considered in the context of a finite planet.

In this view, trends in population, resource consumption and environmental degradation can be significant, or even dominant, determinants of the options available to human societies. A well-known, early example of this genre is the Limits to Growth study, sponsored by the Club of Rome, which modeled world trends by using systems dynamics.10 A more recent example is the work of the Global Scenario group, convened by the Stockholm Environment Institute (SEI).11 This work was informed by systems-dynamics thinking, but focused on identifying the qualitative characteristics of possible future worldwide scenarios for human civilization. SEI identified three types of scenario, with two variants of each type, as shown in Table 2-2. The Conventional Worlds scenario has Market Forces and Policy Reform variants, the Barbarization scenario has Breakdown and Fortress World variants, while the Great Transitions scenario has Eco-Communalism and New Sustainability Paradigm variants.

The SEI scenarios provide a useful framework for considering the paths that human civilization could follow during the next century and beyond. Not all paths are possible.

Notably, continued trends of resource depletion and irreversible degradation of ecosystems would limit the range of options available to succeeding generations.

8 Marshall and Gurr, 2005.

9 Kugler, 1995.

'0Meadows et al, 1972.

11Raskin et al, 2002.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 10 Similarly, destruction of human and industrial capital through large-scale warfare could inhibit economic and social recovery for many generations.

At present, the dominant world paradigm corresponds to the Market Forces scenario.

Policy Reform is pursued at the rhetorical level, but is weakly implemented in practice.

In parts of the world, notably in Africa, the Breakdown scenario is already operative.

Aspects of the Fortress World scenario are also evident, and are likely to become more prominent if trends of resource depletion and ecosystem degradation continue, especially if major powers reject the dictates of sustainability and use armed force to secure resources. One sign of resource depletion is a growing body of analysis that predicts a peak in world oil production within the next few decades.12 This prediction is sobering in view of the prominent role played by oil in the origins and conduct of war in the 20th century.' 3 A now-familiar sign of ecosystem degradation is anthropogenic, global climate change. Analysts are considering the potential for climate change to promote, through its adverse impacts, social disorder and violence.14 Other manifestations of ecosystem degradation are also significant. The recent Millennium Ecosystem Assessment determined that 15 out of the 24 ecosystem services that it examined "are being degraded or used unsustainably, including fresh water, capture fisheries, air and water purification, and the regulation of regional and local climate, natural hazards, and pests".' 5 According to analysts at the United Nations University in Bonn, continuation of such trends could create up to 50 million environmental refugees by the end of the 6

decade.'

At present, human population and material consumption per capita are growing to a degree that visibly stresses the biosphere. Moreover, ecosystem degradation and resource depletion coexist with economic inequality, increasing availability of sophisticated weapons technology, and an immature system of global governance. Major powers are doing little to address these problems. It seems unlikely that these imbalances and sources of instability will persist at such a scale during the remainder of the 21 st century without major change occurring. That change could take various forms, but two broad-brush scenarios can illustrate the range of possible outcomes. In one scenario, there would be a transition to a civilization similar to the New Sustainability Paradigm articulated by SEI. That civilization would be comparatively peaceful and technologically sophisticated. Alternatively, the world could descend into a form of barbarism such as the Fortress World scenario articulated by SEI. That society might be locally prosperous, within enclaves, but would be violent and unstable.

In considering the level of security that should be built into an ISFSI, it would be prudent to adopt a pessimistic assumption of the potential for violent conflict in the future. Using SEI terminology, one could assume a Fortress World scenario with a high incidence of 12Hirsch et al, 2005; GAO, 2007.

13Yergin, 1991.

14 Gilman et al, 2007.

15MEA, 2005, page 1.

16 Adam, 2005.

Assessing Risks of PotentialMalicious Actions at CommercialNuclearFacilities:

The Case of a ProposedlSFSJ at the Diablo Canyon Site Page 11 violent conflict of a type that involves sophisticated weapons and'tactics. Violence might be perpetrated by national governments or by sub-national groups. 7 A RAND corporation analyst has contemplated such a future in the following terms:'

"A dangerous world may offer an insidious combination of nineteenth-century politics, twentieth-century passions, and twenty-first century technology: an explosive mixture of multipolarity, nationalism, and advanced technology."

2.2 National Policy and Practice on Homeland Security To mount an effective response to the general threat environment for the US homeland, the nation needs a coherent homeland-security strategy that links responses to an array of specific threats, such as the potential for a deliberate attack on a commercial nuclear facility. As discussed below, there are deficiencies in the strategy that has actually been implemented. The nominal strategy was articulated by the White House in the National Strategyfor Homeland Security, which was published in July 2002, and that guidance document apparently remains oVerative. The document sets forth three strategic objectives, in order of priority:

" Prevent terrorist attacks within the United States;

• Reduce America's vulnerability to terrorism; and

" Minimize the damage and recover from attacks that do occur."

In pursuit of those objectives, the National Strategyfor HomelandSecurity identifies six major mission areas: (i) intelligence and warning; (ii) border and transportation security; (iii) domestic counterterrorism; (iv) protecting critical infrastructure; (v) defending against catastrophic terrorism; and (vi) emergency preparedness and response. The fourth of those mission areas is highly relevant to nuclear reactors, spent-fuel pools, and ISFSIs, which are important elements of the nation's critical infrastructure. The other five mission areas are also relevant. to nuclear facilities in various ways.

Protecting criticalinfrastructure The US Department of Homeland Security has issued the NationalInfrastructure ProtectionPlan (NIPP), whose purpose is to provide "the unifying structure for the integration of critical infrastructure and key resources (Cl/KR) protection into a single national program". 19 Other federal agencies, including the NRC, have confirmed their acceptance of the NIPP.

The NIPP identifies three purposes of measures to protect critical infrastructure and key resources: (i) deter the threat; (ii) mitigate vulnerabilities; and (iii) minimize 17 Kugler, 1995, page 279.

18White House, 2002, page vii.

19 DHS, 2006, page iii.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities.

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 12 consequences associated with an20 attack or other incident. The NIPP identifies a range of protective measures as follows:

"Protection can include a wide range of activities such as improving business protocols, hardening facilities, building resiliency and redundancy, incorporating hazard resistance into initial facility design, initiating active or passive countermeasures, installing security systems, leveraging "self-healing" technologies, promoting workforce surety programs, or implementing cyber security measures, among various others".

Protective measures of these types could significantly reduce the probability that an attack would be successful. Such measures could, therefore, "deter" attacks by altering attackers' cost-benefit calculations. That form of deterrence is different from deterrence attributable to an attacked party's capability to counter-attack. For convenience, the two forms of deterrence are described hereafter as "protective deterrence" and "counter-attack deterrence". It should be noted that the effective functioning of both forms of deterrence requires that: (i) potential attackers are aware of the deterrence strategy; and (ii) the deterrence strategy is technically credible. That requirement means that the existence and capabilities of protective measures, such as those identified in the NIPP, should be widely advertised. The technical details of a protective measure should, however, remain confidential if disclosure of those details would allow the measure to be defeated.

From the statement quoted above, it is clear that the authors of the NIPP recognize the potential benefits of designing protective measures into a facility before it is constructed.

At the design stage, attributes such as resiliency, redundancy, hardening and passive operation can often be incorporated into a facility at a comparatively low incremental cost. Capturing opportunities for low-cost enhancement of protective measures would allow decision makers to design against a more pessimistic (i.e., more prudent) threat assumption, thereby strengthening protective deterrence, reducing the costs of other security functions (e.g., guard forces), and enhancing civil liberties (e.g., by reducing the perceived need for measures such as wiretapping). Moreover, incorporation of enhanced protective measures would often reduce risks associated with conventional accidents (e.g., fires), extreme natural events (e.g., earthquakes), or other challenges not directly attributable to human malice.

Protective deterrence aspart of a balancedpolicy for homeland security As mentioned in Section 2.1, above, reducing the risks of attack by sub-national groups requires a sophisticated, multi-faceted and sustained policy. The policy must balance multiple factors operating within and beyond the homeland. An unbalanced policy can be ineffective or counterproductive.

20 DHS, 2006, page 7.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities:

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 13 A high-level task force convened by the Council on Foreign Relations (CFR) in 2002 understood the need for a balanced policy for homeland security. 2 1 One of the task force's major conclusions recognized the value of protective deterrence, while also recognizing that offensive military operations by the US could increase the risk of attack on the US. The conclusion was as follows:22 "Homelandsecurity measures have deterrence value: US counterterrorism initiatives abroad can be reinforced by making the US homeland a less tempting target. We can transform the calculations of would-be terrorists by elevating the risk that (1) an attack on the United States will fail, and (2) the disruptive consequences of a successful attack will be minimal. It is especially critical that we bolster this deterrent now since an inevitable consequence of the US government's stepped-up military and diplomatic exertions will be to elevate the incentive to strike back before these efforts have their desired effect."

The NIPP could support a vigorous national program of protective deterrence, as recommended by the CFR task force in 2002. However, current priorities of the US government are not consistent with such a program. Resources and attention devoted to offensive military operations are much larger than those devoted to the protection of critical infrastructure. 23 The White House states, in the NationalStrategy for Combating Terrorism, issued in September 2006:24 "We have broken old orthodoxies that once confined our counterterrorism efforts primarily to the criminal justice domain." In practice, that statement means that the US government relies overwhelmingly on military means to reduce the risks of attacks on US assets by sub-national groups. That policy continues despite mounting evidence, as illustrated by Table 2-1, that it is unbalanced and counterproductive.

A well-informed analyst of homeland security summarizes current national priorities in the following statement:25 "Since the White House has chosen to combat terrorism as essentially a military and intelligence activity, it treats homeland security as a decidedly second-rate priority. The job of everyday citizens is to just go about their lives, shopping and traveling, while the. Pentagon, Central Intelligence Agency, and National Security Agency wage the war."

During a future Presidential administration, national priorities may shift, leading to greater emphasis on protective deterrence. Unfortunately, critical-infrastructure facilities 21 Members of the task force included two former Secretaries of State, two former chairs of the Joint Chiefs of Staff, a former Director of the CIA and the FBI, two former US Senators, and other eminent persons.

22 Hart et al, 2002, pp 14-15.

23 Flynn, 2007.

24 White House, 2006, page 1.

25 Flynn, 2007, page 11.

Assessing Risks of PotentialMalicious Actions at Commercial Nuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 14 constructed prior to that policy shift may lack the protective design features that are envisioned in the NIPP. Persons responsible for the design of currently-proposed facilities, such as the proposed ISFSI at Diablo Canyon, could anticipate a national policy shift and take design decisions accordingly.

Table 2-3 illustrates the options and issues that should be considered in developing a balanced policy for protecting US critical infrastructure from attack by sub-national groups. This illustrative table shows the potential benefits that could be gained by assigning a higher priority to protective deterrence.

2.3 Commercial Nuclear Facilities as Potential Targets of Attack The NationalStrategyfor Combating Terrorism discusses the importance of protecting critical infrastructure and key resources. Potential targets in this category are described as: "systems and assets so vital that their destruction or incapacitation would have a debilitating effect on the security of our Nation". In listing targets in this category, the Strategy includes: "nuclear reactors, materials, and waste".26 An ISFSI at Diablo Canyon would clearly fit within that class of targets.

A sub-national group contemplating an attack within the US homeland would have a wide choice of targets. Also, groups in that category could vary widely in terms of their capabilities and motivations. In the context of potential attacks on nuclear facilities, the groups of concern are those that are comparatively sophisticated in their approach and comparatively well provided with funds and skills. The group that attacked New York and Washington in September 2001 met this description. A group of this type could choose to attack a US nuclear facility for one or both of two broad reasons. First, the attack could be highly symbolic. Second, the impacts of the attack could be severe.

Nuclearfacilities as symbolic targets From the symbolic perspective, commercial nuclear facilities are inevitably associated with nuclear weapons. The association further extends to the United States' large and technically sophisticated capability for offensive military operations. Application of that capability has aroused resentment in many parts of the world. Although nuclear weapons have not been used by the United States since 1945, US political leaders have repeatedly threatened, implicitly or explicitly, to use nuclear weapons again. Those threats coexist with efforts to deny nuclear weapons to other countries. The US government justified its March 2003 invasion of Iraq in large part by the possibility that the Iraqi government might eventually deploy nuclear weapons. There is speculation that the United States will attack nominally commercial nuclear facilities in Iran to forestall Iran's deployment of nuclear weapons.27 Yet, the US government rejects the constraint of its own nuclear weapons by international agreements such as the Non-Proliferation Treaty. 28 As an 26 White House, 2006, page 13.

27 Hersh, 2006; Brzezinski, 2007.

28 Deller, 2002; Scarry, 2002; Franceschini and Schaper, 2006.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 15 approach to international security, this policy has been criticized by the director general of the International Atomic Energy Agency as "unsustainable and counterproductive" .29 It would be prudent to assume that this policy will motivate sub-national groups to respond asymmetrically to US nuclear superiority, possibly through an attack on a US commercial nuclear facility.

Radiologicalimpacts of an attack on a nuclearfacility The impacts of an attack on a commercial nuclear facility could be severe because these facilities typically contain large amounts of radioactive material. Release of this material to the environment could create a variety of severe impacts. Also, as explained in Section 2.4, below, US nuclear facilities are provided with a defense that is "light" in a military sense. Moreover, imprudent design choices have made a number of these facilities highly vulnerable to attack. That combination of factors means that many US nuclear facilities can be regarded as potent radiological weapons that await activation by an enemy.

Nuclear facilities contain a variety of radioactive isotopes, but one isotope, namely cesium- 137, is especially useful as an indicator of the potential for radiological harm.

Cesium-137 is a radioactive isotope with a half-life of 30 years. This isotope accounts for most of the offsite radiation exposure that is attributable to the 1986 Chernobyl reactor accident, and for about half of the radiation exposure that is attributable to fallout from the testing of nuclear weapons in the atmosphere. 30 Cesium is a volatile element that would be liberally released during conventional accidents or attack scenarios that involve overheating of nuclear fuel.

Table 2-4 shows estimated amounts of cesium-137 in nuclear fuel in the Diablo Canyon reactors and spent-fuel pools, and in one of the spent-fuel storage modules of the proposed Diablo Canyon ISFSI. Table 2-5 compares these amounts with atmospheric releases of cesium-137 from detonation of a 10-kilotonne fission weapon, the Chernobyl reactor accident of 1986, and atmospheric testing of nuclear weapons. These data indicate that release of a substantial fraction of the cesium- 137 in a Diablo Canyon nuclear facility could create comparatively large radiological impacts.

Land contamination by cesium-13 7 The radiological impacts of an atmospheric release of cesium-137 arise primarily from land contamination. Small particles containing cesium-137 are deposited on soil, vegetation and buildings. These particles emit gamma radiation that affects people who travel through or reside in the contaminated area. Food and water supplies also become contaminated. Over time, the amount of deposited cesium-137 is reduced through radioactive decay (with a half-life of 30 years) and through natural processes 29 ElBaradei, 2004, page 9.

30 DOE, 1987.

Assessing Risks ofPotentialMaliciousActions at Commercial Nuclear Facilities:

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 16 (weathering) that carry cesium deeper into soil or into streams and lakes where it is deposited in sediments.

One measure of the radiological impacts attributable to deposition of cesium-137 is the area of land that would become uninhabitable. For illustration, assume that the threshold of uninhabitability is an external, whole-body dose of 10 rem over 30 years. That level of radiation exposure, which would represent about a three-fold increase above the typical level of background (natural) radiation, was used in the NRC's 31 1975 Reactor Safety Study as a criterion for relocating populations from rural areas.

A radiation dose of 10 rem over 30 years corresponds to an average dose rate of 0.33 rem per year.32 The health effects of radiation exposure at this dose level have been estimated by the National Research Council's Committee on the Biological Effects of Ionizing Radiations (BEIR V committee). 33 The committee estimated that a continuous lifetime exposure of 0.1 rem per year would increase the incidence of fatal cancers in an exposed population by 2.5 percent for males and 3.4 percent for females.34 Incidence would scale linearly with dose, in this low-dose region. 35 Thus, an average lifetime exposure of 0.33 rem per year would increase the incidence of fatal cancers by about 8 percent for males and 11 percent for females. About 21 percent of males and 18-percent of females normally die of cancer. 36 In other words, in populations residing continuously at the threshold of uninhabitability (an external dose rate of 0.33 rem per year), about 2 percent of people would suffer a fatal cancer that would not otherwise occur. 37 Internal doses from contaminated food and water could cause additional cancer fatalities.

An average dose rate of 0.33 rem per year would be experienced at the boundary of the uninhabitable area. Within that area, the external dose rate from cesium-137 would exceed the threshold of 10 rem over 30 years. At some locations, the dose rate could exceed this threshold by orders of magnitude. Therefore, persons choosing to live within the uninhabitable area could experience an incidence of fatal cancers at a level higher than is set forth above.

For a postulated release of cesium-137 to the atmosphere, the area of uninhabitable land can be estimated from calculations done by Jan Beyea.38 Two releases of cesium-137 are 31 NRC, 1975, Appendix VI, page 11-17.

32 At a given location contaminated by cesium-1 37, the resulting external, whole-body dose received by a person at that location would decline over time, due to radioactive decay and weathering of the cesium-137.T Thus, a person receiving 10 rem over an initial 30-year period would receive a lower dose over the subsequent 30 -year period.

33 National Research Council, 1990.

34 National Research Council, 1990, Table 4-2.

35 The BEIR V committee assumed a linear dose-response model for cancers other than leukemia, and a model for leukemia that is effectively linear in the low-dose range. See: National Research Council, 1990, pp 36 171-176.

National Research Council, 1990, Table 4-2.

37 For males, 0.08 x 0.21 = 0.0 17. For females, 0.11 x 0.18 = 0.020.

38 Beyea, 1979. Related calculations are provided in: Alvarez et al, 2003; Beyea et al, 2004.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 17 postulated here, drawing upon data from Table 2-4. The first release is 30 million Curies, representing about one-half of the cesium-137 in a Diablo Canyon spent-fuel pool. The second postulated release is 3 million Curies, representing about one-half of the cesium-137 in the core of a Diablo Canyon reactor, or about one-half of the cesium- 137 in four spent-fuel storage modules of a Diablo Canyon ISFSI. For typical weather conditions, a release of 30 million Curies of cesium-137 would render about 75,000 square kilometers of land uninhabitable, assuming that the radioactive plume travels inland rather than out to sea. A release of 3 million Curies would render uninhabitable about 7,500 square kilometers.

An atmospheric release of 50 percent of the cesium-137 in a Diablo Canyon spent-fuel pool would be a likely outcome of a conventional accident or attack that causes the water level in the pool to fall below the top of the fuel-storage racks. 3 9 Similarly, a release of 50 percent of the cesium-137 in a Diablo Canyon reactor would be a likely outcome of a range of potential accidents or attacks that affect the reactor. This report focuses on the Diablo Canyon ISFSI rather than the reactors and spent-fuel pools. The potential release of cesium-137 from the Diablo Canyon ISFSI is addressed in Section 4, below.

2.4 The NRC's Approach to Nuclear-Facility Security A policy on protecting nuclear facilities from attack is laid down in NRC regulation 10 CFR 50.13. That regulation was promulgated in September 1967 by the US Atomic Energy Commission (AEC) - which preceded 40 the NRC - and was upheld by the US Court of Appeals in August 1968. It states:

"An applicant for a license to construct and operate a production or utilization facility, or for an amendment to such license, is not required to provide for design features or other measures for the specific purpose of protection against the effects of (a) attacks and destructive acts, including sabotage, directed against the facility by an enemy of the United States, whether a foreign government or other person, or (b) use or deployment of weapons incident to US defense activities."

Some readers might interpret 10 CFR 50.13 to mean that licensees are not required to design or operate nuclear facilities to resist potential attacks by sub-national groups. The NRC has rejected that interpretation in the context of vehicle-bomb attacks, stating:41 "It is simply not the case that a vehicle bomb attack on a nuclear power plant would almost certainly represent an attack by an enemy of the United States, within the meaning of that phrase in 10 CFR 50.13."

Events have obliged the NRC to progressively require greater protection against attacks by sub-national groups. A series of events, including the 1993 vehicle-bomb attack on 39 Alvarez et al, 2003; Thompson, 2006; National Research Council, 2006.

40 Federal Register, Vol. 32, 26 September 1967, page 13445.

41NRC, 1994, page 38893.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 18 the World Trade Center in New York, persuaded the NRC to introduce, in 1994, regulatory amendments requiring licensees to defend nuclear power plants against vehicle bombs.42 The attacks on New York and Washington in September 2001 led the NRC to require additional protective measures.

With rare exceptions, the NRC has refused to consider potential malicious actions in the context of license proceedings or environmental impact statements. The NRC's policy on this matter is illustrated by a September 1982 ruling by the Atomic Safety and Licensing Board (ASLB) in the operating-license proceeding for the Harris nuclear power plant.

An intervenor, Wells Eddleman, had proffered a contention alleging, in part, that the plant's safety analysis was deficient because it did not consider the "consequences of terrorists commandeering a very large airplane ..... and 4diving 3

it into the containment." In refusing to consider this contention, the ASLB stated:

"This part of the contentionis barred by 10 CFR 50.13. This rule must be read in parimateria with 10 CFR 73.1 (a)(1), which describes the "design basis threat" against which commercial power reactors are required to be protected. Under that provision, a plant's security plan must be designed to cope with a violent external assault by "several persons," equipped with light, portable weapons, such as hand-held automatic weapons, explosives, incapacitating agents, and the like.

Read in the light of section 73.1, the principal thrust of section 50.13 is that military style attacks with heavier weapons are not a part of the design basis threat for commercial reactors. Reactors could not be effectively protected against such attacks without turning them into virtually impregnable fortresses at much higher cost. Thus Applicants are not required to design against such things as artillery bombardments, missiles with nuclear warheads, or kamikaze dives by large airplanes, despite the fact that such attacks would damage and may well destroy a commercial reactor."

The design basis threat The NRC requires its licensees to defend against a design basis threat (DBT), a postulated attack that has become more severe over time. The present DBT for nuclear power plants was promulgated in January 2007. Details are not publicly available. (The NRC publishes a summary description, which is provided below.) The present DBT is similar to one ordered by the NRC in April 2003.4* At that time, the NRC described its 45 order as follows:

"The Order that imposes revisions to the Design Basis Threat requires power plants to implement additional protective actions to protect against sabotage by terrorists and other adversaries. The details of the design basis threat are 42 NRC, 1994.

4 ASLB, 1982.

44 NRC Press Release No.07-012, 29 January 2007.

4' NRC Press Release No.03-053, 29 April 2003.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 19 safeguards information pursuant to Section 147 of the Atomic Energy Act and will not be released to the public. This Order builds on the changes made by the Commission's February 25, 2002 Order. The Commission believes that this DBT represents the largest reasonable threat against which a regulated private security force should be expected to defend under existing law."

From that statement, and from other published information, it is evident that the NRC requires a comparatively "light" defense for nuclear power plants and their spent fuel.

The scope of the defense does not reflect a full spectrum of threats. Instead, it reflects a consensus about the level of threat that licensees can "reasonably" be expected to resist. 46 In illustration of this approach, when the NRC adopted the currently-applicable DBT rule in January 2007, it stated that the rule "does not require protection against a deliberate hit by a large aircraft", and that "active protection [of nuclear power plants] against 47 airborne threats is addressed by other federal organizations, including the military".

The present DBT for48"radiological sabotage" at a nuclear power plant has the following published attributes:

"(i) A determined violent external assault, attack by stealth, or deceptive actions, including diversionary actions, by an adversary force capable of operating in each of the following modes: A single group attacking through one entry point, multiple groups attacking through multiple entry points, a combination of one or more groups and one or more individuals attacking through multiple entry points, or individuals attacking through separate entry points, with the following attributes, assistance and equipment:

(A) Well-trained (including military training and skills) and dedicated individuals, willing to kill or be killed, with sufficient knowledge to identify specific equipment or locations necessary for a successful attack; (B) Active (e.g., facilitate entrance and exit, disable alarms and communications, participate in violent attack) or passive (e.g., provide information), or both, knowledgeable inside assistance; (C) Suitable weapons, including handheld automatic weapons, equipped with silencers and having effective long range accuracy; (D) Hand-carried equipment, including incapacitating agents and explosives for use as tools of entry or for otherwise destroying reactor, facility,, transporter, or container integrity or features of the safeguards system; and (E) Land and water vehicles, which could be used for transporting personnel and their hand-carried equipment to the proximity of vital areas; and 46 Fertel, 2006; Wells, 2006; Brian, 2006.

47 NRC Press Release No.07-012, 29 January 2007.

48 10 CFR 73.1 Purpose and scope, accessed from the NRC web site (www.nrc.gov) on 14 June 2007.

Assessing Risks of PotentialMalicious Actions at Commercial NuclearFacilities:

The Case of a ProposedJSFSJ at the Diablo Canyon Site Page 20 (ii) An internal threat; and (iii) A land vehicle bomb assault, which may be coordinated with an external assault; and (iv) A waterborne vehicle bomb assault, which may be coordinated with an external assault; and (v) A cyber attack."

That DBT seems impressive, and is more demanding than previously-published DBTs.

However, the DBT cannot be highly demanding in practice, given the equipment that the NRC requires for a security force. Major items of required equipment are semiautomatic rifles, shotguns, semiautomatic pistols, bullet-resistant vests, gas masks, and flares for night vision. 49 Plausible attacks could overwhelm a security force equipped in this manner. Also, press reports state that the assumed attacking force contains no more than six persons.5 ° Table 2-6 sets forth some potential modes and instruments of attack on a nuclear power plant, and summarizes the present defenses against these modes and instruments. That table shows that a variety of potential attack scenarios could not be effectively resisted by present defenses. Potential attacks on an ISFSI are discussed in Section 4, below.

Protectivedeterrence and the NRC A rationale for the present level of protection of nuclear facilities was articulated by the NRC chair, Richard Meserve, in 2002:51 "If we allow terrorist threats to determine what we build and what we operate, we will retreat into the past - back to an era without suspension bridges, harbor tunnels, stadiums, or hydroelectric dams, let alone skyscrapers, liquid-natural-gas terminals, chemical factories, or nuclear power plants. We cannot eliminate the terrorists' targets, but instead we must eliminate the terrorists themselves. A strategy of risk avoidance -

the elimination of the threat by the elimination of potential targets - does not reflect a sound response."

That statement shows no understanding of the need for a balanced policy to protect critical infrastructure, employing the principles of protective deterrence. There is considerable potential to embody those principles in the design of nuclear facilities, especially new facilities. It has been known for decades that nuclear power plants could be designed to be more robust against attack. For example, in the early 1980s the reactor vendor ASEA-Atom developed a preliminary design for an "intrinsically safe" commercial reactor known as the PIUS reactor. Passive-safety design principles were 49 10 CFR 73 Appendix B - General Criteria for Security Personnel,Section V, accessed from the NRC web site (www.nrc.gov) on 14 June 2007.

50 Hebert, 2007.

51 Meserve, 2002, page 22.

Assessing Risks of PotentialMalicious Actions at Commercial Nuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 21 used. The design basis for the PIUS reactor included events such as equipment failures, operator errors and earthquakes, but also included: (i) takeover of the plant for one operating shift by knowledgeable saboteurs equipped with large amounts of explosives; (ii) aerial bombardment with 1,000-pound bombs; and (iii) abandonment of the plant by the operators for one week.52 An ISFSI could be designed to withstand similar threats.

Considerationof malicious actions in environmental impact statements As stated above, the NRC has generally refused to consider potential malicious actions in environmental impact statements. An exception is the NRC's August 1979 Generic EnvironmentalImpact Statement on Handling and Storage of Spent Light Water Power Reactor Fuel (NUREG-0575), which considered potential sabotage events at a spent-fuel pool. 53 Table 2-7 describes the postulated events, which encompassed the detonation of explosive charges in the pool, breaching of the walls of the pool building and the pool floor by explosive charges or other means, and takeover of the central control room for one half-hour. Involvement of up to about 80 adversaries was implied.

NUREG-0575 did not recognize the potential for an attack with these attributes to cause a fire in the pool. 54 Technically-informed attackers operating within this envelope of attributes could cause a fire in a spent-fuel pool at Diablo Canyon or any other operating nuclear power plant in the US. 55 Informed attackers could use explosives, and their command of the control room for one half-hour, to drain water from the pool and release radioactive material from the adjacent reactor. The radiation field from the reactor release and the drained pool could preclude personnel access, thus precluding recovery actions if command of the plant were returned to the operators after one half-hour.

Exposure of spent fuel to air would initiate a fire that would release to the atmosphere a large fraction of the pool's inventory of cesium-137. 56

3. An Appropriate Framework for Assessing the Risks of Malicious Actions at Nuclear Facilities 3.1 Extending Traditional Risk Assessment to Encompass Malicious Actions Over a three-decade period, the NRC has accepted, in various contexts, that an analysis of a nuclear facility's environmental impacts should consider a range of conventional accidents. Here, the term "conventional accidents" refers to incidents caused by human error, equipment failure or natural events, but excludes incidents caused by malicious actions. The radiological impacts of conventional accidents are examined through the 52 Hannerz, 1983.

" NRC, 1979, Section 5 and Appendix J.

54 The sabotage events postulated in NUREG-0575 yielded comparatively small radioactive releases.

51 Spent-fuel pools at Diablo Canyon and other US nuclear power plants are currently equipped with high-density racks for holding spent fuel. Loss of water from a pool equipped with high-density racks would, over a wide range of water-loss scenarios, lead to ignition and burning of spent fuel assemblies.

56 Alvarez et al, 2003; Thompson, 2006; National Research Council, 2006.

Assessing Risks of PotentialMaliciousActions at Commercial Nuclear Facilities.

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 22 use of risk-assessment tools such as probabilistic risk assessment (PRA). The first PRA for a commercial nuclear reactor was the Reactor Safety Study.57 A PRA for a nuclear facility considers a number of conventional accident scenarios, estimating both their radiological consequences and their probabilities of occurrence. In a competently-conducted PRA study, a conventional accident scenario is not screened out a priori if its probability is thought to be low. Instead, the scenario's radiological consequences and probability are systematically estimated to determine its contribution to the overall risks associated with the facility.

The traditional tools and practices of radiological risk assessment should be adapted to address the risks of malicious actions at a nuclear facility. In this application of risk assessment, conventional accident scenarios would be replaced by attack scenarios.

(These are also known as threat scenarios.) Probability would be treated differently in this application, however, because there is usually no statistical basis to support quantitative estimates of the probabilities of malicious actions. To accommodate that problem, occurrence of a representative set of malicious actions would be assumed. The scenarios flowing from each postulated malicious action would then be analyzed to estimate the conditional probabilities and other characteristics of the outcomes, including radiological impacts. The resulting information would be useful for a variety of purposes. It would, for example, help to identify options to reduce the risks of malicious actions through changes in the design or mode of operation of the facility. PRA-related studies have been very helpful in this respect in the context of conventional accidents.

Information obtained by assuming the occurrence of a set of malicious actions should be combined with qualitative estimates of the probabilities of the malicious actions, to yield risk findings that have qualitative and quantitative components. The process of combination should occur in such a way that assumptions and qualitative estimates of probability can be re-visited at any time. With that provision, new information or differing professional opinions could be factored into the risk findings without difficulty.

A standardized terminology should be developed to facilitate reasoned discussion of assumptions and qualitative estimates.

The NRC, in developing its 1994 ruling on protection of nuclear power plants against vehicle bombs, adopted the PRA-adaptation approach described above, stating:58 "The NRC does not believe that it can quantify the likelihood of vehicle bomb attack. However, it has performed a conditional probabilistic risk analysis for an existing power reactor site, assuming an attempt to damage a nuclear power plant with a design basis vehicle bomb placed at locations within the protected area that would create the greatest risk to public health and safety. The analysis indicated that the contribution to core damage frequency could be high."

57 NRC, 1975.

58 NRC, 1994, page 38891.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 23 The NRC argued that its vehicle-bomb ruling was "prudent" in view of a vehicle intrusion incident at the Three Mile Island site and a vehicle bombing of the World Trade Center in February 1993.59 In support of this view, the NRC noted that the 1993 World Trade Center bombing was "organized within the United States 60 and implemented with materials obtained on the open market in the United States".

The vehicle-bomb ruling was a step forward in that the NRC recognized one form of threat scenario (use of a vehicle bomb) for an attack on a nuclear facility by a sub-national group. However, the NRC failed to recognize other threat scenarios that are at least as credible. Section 4.3, below, discusses other, credible scenarios in the context of an ISFSI; analogous scenarios are relevant to power reactors and spent-fuel pools. Also, the NRC failed to develop a standardized terminology for assumptions and qualitative estimates regarding the probabilities of attack scenarios. At present (June 2007), the NRC still lacks such a terminology.

Assessment of malice-related risks, as described here, would typically involve the use of sensitive information. Here, the term "sensitive" refers to detailed information that could substantially assist an attacking group to attain its objectives. Management of sensitive information is discussed in Section 3.3, below.

In reviewing a license application for a nuclear facility, the NRC considers a set of design-basis conventional accidents. That consideration occurs under the umbrella of the Atomic Energy Act. An analogous situation pertains in the security realm. There, the NRC considers a facility's ability to withstand a design-basis threat. That consideration also occurs under the umbrella of the Atomic Energy Act. However, when the NRC examines a facility's environmental impacts, it does so under the umbrella of NEPA. In performing such examinations, the NRC has repeatedly accepted that it should consider conventional accidents more severe than design-basis conventional accidents. Logic indicates, therefore, that an assessment by the NRC of the risks of malicious actions at a nuclear facility, conducted under the umbrella of NEPA, should consider reasonably foreseeable threats more severe than design-basis threats.

3.2 Examining a Full Range of Risks, Risk-Reducing Options and their Implications A competently-performed assessment of the conventional accident risks at a nuclear facility would consider radiological risks. The assessment would also identify and characterize options for reducing those risks by modifying the facility's design or mode of operation. Articulating knowledge about such options is an important purpose of NEPA.

Essentially the same requirements should apply to an assessment of the risks of malicious actions. The latter assessment should consider radiological risks and options for reducing those risks.

59 NRC, 1994, Summary.

60 NRC, 1994, page 38891.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 24 Additional risks and impacts Risks and impacts arising from the potential for malicious actions are not limited to radiological risks. Social and economic impacts could be caused by malicious actions, the expectation of malicious actions, the choice of design options, or other factors. The term "additional risks and impacts" is used here to encompass the potential for such impacts. These additional risks and impacts deserve careful research, and it is premature to provide a taxonomy of them. Additional risks and impacts, and their relationships with risk-reducing options, should be examined in any malice-related risk assessment. The following, simplified example illustrates some additional risks and impacts, and shows the importance of considering them in a risk assessment.

Consider a proposed nuclear facility (e.g., a reactora spent-fuel pool, or an ISFSI) that would contain a large amount of radioactive material. There are two design options.

Option A would employ a design that was developed one or more decades ago. It would have a comparatively low ability to resist an attack. To compensate for its vulnerability, it would be protected .by a large force of armed guards. Detailed information about the option's design, and about the guard force, would be secret. The public would be excluded from any effective role in the licensing of this option. Option B would employ a design using hardening, resiliency and passive protection as envisioned in the NIPP. It would have a comparatively high ability to resist an attack. As a result, a less capable guard force would be required, there would be no need for secrecy, and the public would have full access to license proceedings.

To further simplify this example, assume that the estimated life-cycle costs and radiological risks of Options A and B would be identical. In that case, Option A would be clearly inferior because it would increase the use of secret information and decrease the public's role in decision-making, tendencies that are antithetical to US traditions and inconsistent with long-term national prosperity. Put differently, Option A would have higher levels of social and economic impacts. Moreover, if a malicious action were to cause a release of radioactive material, the social and economic impacts could be higher if Option A had been chosen, because that choice would have relegated the public to a lesser role.

The preceding example, although simplified, is far from theoretical. Design options have been employed that are highly vulnerable to attack, and the NRC has become much more secretive in recent years. Consider the case of spent-fuel pools equipped with high-density racks. All the spent-fuel pools at US nuclear power plants are so equipped. The NRC asserts that these pools are adequately safe and secure. Yet, since September 2001 the NRC has not published any technical analysis on the safety and security of spent-fuel pools, and has denied requests by intervenors that spent-fuel-pool risks be addressed in evidentiary hearings. As a result, the NRC has never published any analysis on the risks of a spent-fuel-pool fire initiated by malicious action, and has never allowed an examination of these risks in a license proceeding. In this real-world case, spent-fuel

Assessing Risks of PotentialMalicious Actions at Commercial Nuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 25 pools equipped with high-density racks are Option A. An Option B is available, namely re-equipping the pools with low-density, open-frame racks, as was intended when the present generation of US nuclear power plants was designed. 6' Cumulative risks of closely-associatedfacilities Many nuclear facilities are closely associated with other nuclear facilities. For example, the Diablo Canyon site features two reactors and two spent-fuel pools. These four facilities are in close physical proximity and share many supporting systems. As a result, the conventional accident risks and malice-related risks associated with any one of these four facilities can only be properly understood through analyses that consider interactions among all four facilities. The proposed ISFSI at Diablo Canyon would share the guard force and other security measures that are deployed at the site. A release of radioactive material from the ISFSI could affect the operation of the reactors and pools, and vice versa. Thus, malice-related risks at the ISFSI should be considered in the context of malice-related risks across the entire site. Also, the ISFSI would be used to support continued operation of the reactors. Thus, risks arising from operation of the ISFSI over its lifetime should be viewed in the context of reactor risks.

To generalize from the Diablo Canyon example, any assessment of conventional accident risks or malice-related risks should examine the interactions among closely-associated facilities, and should assess the cumulative risks arising from operation of those facilities.

3.3 Managing Sensitive Information A thorough assessment of malice-related risks at a nuclear facility would typically involve the use of sensitive information, defined here as detailed information that could substantially assist an attacking group to attain its objectives. Given this definition, general information about a nuclear facility, including its overall physical layout, operating principles and radioactive inventory, would not be sensitive. Information about the potential radiological impacts of a malicious action would not be sensitive. Detailed information about vulnerable points of the facility, or detailed information about attack scenarios that could exploit such points of vulnerability, could be sensitive. None of the information provided in this report is sensitive.

Sensitive information, as defined here, is not appropriate for general dissemination.

Thus, processes for the assessment of malice-related risks must involve rules and practices for managing sensitive information so that its distribution is limited.

61 In this case, Option B would have a much lower radiological risk than Option A, but a higher capital cost.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 26 The costs ofsecrecy Rules and practices for designating information as sensitive, and for managing information so designated, should recognize that secrecy has high costs. As stated in Section 3.2, above, secrecy is antithetical to US traditions and inconsistent with long-term national prosperity. Thus, an assessment of malice-related risks at a nuclear facility should consider the social and economic impacts of secrecy. That consideration would tend to favor design options involving features such as hardening, resiliency and passive protection. In some instances, secrecy-related impacts could be so high that they outweigh any benefits from operating a nuclear facility. It should be remembered that nuclear facilities exist to serve society, rather than vice versa.

It should also be noted that the safety and security of nuclear facilities will be significantly and adversely affected by an entrenched culture of secrecy. Such a culture is not compatible with a clear-headed, science-based approach to the understanding of risks. Entrenched secrecy perpetuates dogma, stifles dissent, and can create a false sense of security. In illustration, the culture of secrecy in the former USSR was 62 a major factor contributing to the occurrence of the 1986 Chernobyl reactor accident.

The limited effectiveness of knowledge suppression Within the NRC and elsewhere, factions will argue that suppression of knowledge can reduce the risks of malicious actions at nuclear facilities. Knowledge suppression is, however, a strategy with limited effectiveness. Nuclear fission power is a mature technology based on science from the mid-20th century. Detailed information about nuclear technology and individual nuclear facilities is archived at many locations around the world, and large numbers of people have worked in nuclear facilities. Similarly, information about weapons and other devices that could be used to attack nuclear facilities is widely available. Large numbers of people have been trained to use such devices in a military context. Thus, it would be prudent to assume that sophisticated sub-national groups can identify and exploit vulnerabilities in US nuclear facilities.

A balancedapproach to managing sensitive information From the preceding discussion, it is clear that managing sensitive information should be done carefully, balancing several considerations. The NRC has not achieved this balance since September 2001. Instead, the NRC has taken a crude, counterproductive approach in which it is excessively secretive while also making assertions about safety and security that do not withstand critical examination. To help correct this situation, the NRC should engage public stakeholders (citizen groups, academics, state and local governments, etc.)

and licensees in a dialogue that seeks consensus on an effective, balanced policy for 62 Thompson, 2002,Section X.

Assessing Risks ofPotentialMaliciousActions at Commercial NuclearFacilities:

The Case of a ProposedJSFSJ at the Diablo Canyon Site Page 2 7 management of sensitive information. Implementation of that policy would not necessarily require changes in NRC rules.

3.4 Ensuring Compatibility with a Comprehensive National Strategy for Homeland Security Section 2, above, explains the need for a comprehensive, balanced strategy to reduce the risks of attack on US critical infrastructure by sub-national groups. The National InfrastructureProtectionPlan could be a major element of that strategy, supporting a policy of enhanced protective deterrence.

The conduct of thorough assessments of malice-related risks at US nuclear facilities could make a major contribution to implementation of the NIPP. These assessments could provide models to be followed in other infrastructure sectors, such as the chemical industry. Even better, the NRC could work with other agencies to develop a risk-assessment framework that allows risks to be compared not only within an infrastructure sector (such as the nuclear industry, or the chemical industry) but also among sectors.

As an initial step, the NRC should develop malice-related risk assessments that are scientifically credible and meet the other requirements set forth above. While developing these assessments, the NRC should engage in dialogue and cooperative research with other agencies and stakeholders, seeking to develop a pan-sectoral risk-assessment framework.

3.5 Incorporating Findings into an Environmental Assessment or Environmental Impact Statement Sections 3.1 through 3.4, above, outline a set of standards for the conduct of malice-related risk assessments. When those assessments are done, they must be incorporated into EAs or EISs, either retroactively or concurrently. During that process, provision must be made for limiting the dissemination of sensitive information. The best approach would be to place sensitive information in appendices whose dissemination is limited.

The full title of each such appendix, and a general summary of its purpose, scope and findings, should be included in the body of the EA or EIS, which would be openly published.

4. The NRC Staff's Supplement to the Environmental Assessment for the Diablo Canyon ISFSI 4.1 Scope, Assumptions, Methodology and Conclusions of the Staff's Supplement In October 2003, the NRC Staff issued an Environmental Assessment for the proposed ISFSI at Diablo Canyon. Pursuant to a ruling by the 9th Circuit of the US Court of

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 28 Appeals, the Staff issued a Supplement to that EA in May 2007." Here, that Supplement is described as the Diablo EA Supplement. The Supplement addresses the risks of potential malicious actions at the proposed ISFSI. It concludes (at page 7) that "a terrorist attack that would result in a significant release of radiation affecting the public is not reasonably expected to occur".

Shortly after issuing the Diablo EA Supplement, the NRC Staff issued an analogous document related to the application by Pa'ina Hawaii, LLC, to build and operate a commercial, pool-type industrial irradiator in Honolulu, Hawaii, at the Honolulu International Airport. That document is analogous to the Diablo EA Supplement because both respond to the same ruling by the 9th Circuit of the US Court of Appeals. The document takes the form of a Supplemental Appendix to the Staffs Draft EA for the proposed irradiator, which was issued in December 2006.64 Hereafter, the Supplemental Appendix is described as the "Pa'ina EA Appendix".

This report focuses on issues related to the Diablo EA Supplement. However, the Pa'ina EA Appendix provides additional, relevant information, and is therefore briefly examined here.

The Diablo EA Supplement is a short (8-page) document. It claims (at page 1) to address "the environmental impacts from potential terrorist acts directed at the Diablo Canyon ISFSI". It mentions technical analyses related to potential malicious actions at the Diablo Canyon ISFSI, but does not itself provide such analyses. Nor does it cite any document that describes such analyses. It provides only a partial, incomplete view of its underlying assumptions and methodology. Thus, the Supplement's conclusions cannot be linked to a technical base of evidence and analysis.

Defense of the Diablo Canyon ISFSI The Diablo EA Supplement provides (at page 4) a brief discussion of nation-wide security measures implemented by the US government since September 2001. That discussion focuses on measures intended to prevent persons with malicious intent from taking control of commercial aircraft used to carry passengers or cargo. There is no discussion of security measures in the context of smaller, general-aviation aircraft, despite the existence of a large US-based fleet of such aircraft and the potential for such an aircraft to be used, in an explosive-laden configuration, as an instrument of attack on a nuclear facility.

The Supplement goes on to provide (at pages 4 and 5) a discussion of the security measures that the NRC requires licensees to implement at ISFSIs and other nuclear facilities. Major security measures required at ISFSIs include: (i) physical barriers; (ii) surveillance; (iii) intrusion detection; (iv) a response to intrusions; and (v) offsite 63 NRC, 2007a.

64 NRC, 2007b.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 29 assistance from local law enforcement agencies, as necessary. Measures in each category were required prior to September 2001. After September 2001, the NRC conducted what the Staff describes as a "comprehensive review" of the NRC's security program. The review considered threats such as a land-based vehicle bomb, ground assault with the use of an insider, and water-borne assaults. Subsequently, security measures at ISFSIs were enhanced in various respects..

The Diablo EA Supplement does not clearly articulate the relationship between defense of the Diablo Canyon ISFSI and defense of other facilities on the site. Elsewhere, the NRC states that its regulations do not require licensees to defend against the DBT that applies at a nuclear power plant, but, in practice, when an ISFSI is located at a reactor site, the ISFSI is typically included within the reactors' security plan. The NRC further states that the Diablo Canyon licensee has amended its reactor security plan to cover the proposed ISFSI. 65 As explained in Section 2.4, above, the DBT at a nuclear power plant is such that the NRC requires only a light defense of the plant.

Risk-assessment methodology underlying the DiabloEA Supplement As explained in Section 3.1, above, the NRC's consideration of design-basis conventional accidents and design-basis threats in a license proceeding is governed by the Atomic Energy Act. By contrast, preparation of an EA or an EIS is governed by NEPA. The NRC has repeatedly accepted that its assessment of conventional accident risks in an EA or an EIS should consider conventional accidents more severe than design-basis conventional accidents. Logic indicates that its assessment of malice-related risks in an EA or an EIS should consider threats more severe than design-basis threats. Preparation of the Diablo EA Supplement has given the NRC Staff an opportunity to apply that logic, and to employ a credible process for assessment of malice-related risks. Section 3, above, has articulated a standard by which to judge the Staffs assessment.

The Diablo EA Supplement does not provide or cite any technical analyses to support its conclusions, nor does it provide an adequate explanation of the assumptions and methodology that underlie those conclusions. The reader is obliged to rely on a brief and incomplete explanation in the Diablo EA Supplement. Apparently, the Staff employed similar assumptions and methodology in preparing the Pa'ina EA Appendix, which provides slightly more information. Neither document provides a clear and complete explanation of the assumptions and methodology used by the Staff to identify and examine attack scenarios and their impacts. From the limited explanations that are provided, it appears that the Staff employed a crude methodology (a "screening and assessment tool") that was originally intended to determine the adequacy of security measures. That issue falls under the Atomic Energy Act, not under NEPA. Also, some of the assumptions employed by the Staff are inappropriate, as discussed below.

65 NRC, 2007c, Footnote 10.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 30 The Diablo EA Supplement states (at page 6):

"Following issuance of the 2002 security orders for ISFSIs, NRC used a security assessment framework as a screening and assessment tool, to determine whether additional security measures, beyond those required by regulation and the security orders, were warranted for NRC-regulated facilities, including ISFSIs."

Apparently, that process began by identifying a "spectrum" of threat scenarios. The Diablo EA Supplement does not describe the spectrum. From that spectrum, the Staff identified a set of "plausible" threat scenarios through a screening exercise that is not described in the Supplement. The Pa'ina EA Appendix provides slightly more information about threat screening, stating (at page B-5):

"Remote or speculative scenarios and scenarios with insignificant consequences were screened out based on threat assessments and engineering evaluations".

Threat scenarios deemed to be "plausible" were then examined by the Staff as follows (Diablo EA Supplement, page 6):

"For those scenarios deemed plausible, NRC assessed the attractiveness of the facility to attack by taking into account factors such as iconic value, complexity of planning required, resources needed, execution risk, and public protective measures. In addition, NRC made conservative assessments of consequences, to assess the potential for early fatalities from radiological impacts. NRC then looked at the combined effect of the attractiveness and the consequence analyses, to determine whether additional security measures for ISFSIs were necessary."

These words describe an examination that apparently combined qualitative judgments with quantitative analyses. The Diablo EA Supplement provides no further description of the examination, and does not cite any document that provides such a description. Thus, the completeness and quality of the examination cannot be determined, with one exception. That exception is the use of the "potential for early fatalities" as an indicator of radiological impacts. As explained in Section 4.3, below, the potential for early fatalities is a highly inappropriate indicator of the radiological impacts of accidents or attacks at an ISFSI.

The Diablo EA Supplement describes (at pages 6 and 7) how the Staff used its process to consider threat scenarios and radiological impacts in the context of ISFSIs in general, and in the context of the proposed Diablo ISFSI. That application of the process is discussed in Section 4.2, below.

Assessing Risks of PotentialMalicious Actions at Commercial Nuclear Facilities:

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 31 The probability of attack The Diablo EA Supplement addresses the probability of attack in differing, inconsistent ways. It states (at page 6) that the probability of an attack is "believed to be low", but also that it "cannot be reliably quantified". It also states (at page 6) that enhanced security measures and emergency-planning measures have been implemented at ISFSIs "without regard to the probability of an attack". The Supplement claims (at page 6) that these measures reduce the risk of attack to an "acceptable" level. The Supplement does not explain how acceptability was determined.

The Pa'ina EA Appendix takes a different approach'to the probability of attack at commercial nuclear facilities, including irradiators and ISFSIs. It states (at page B-4):

"The NRC staff operates on the premise that a general credible threat exists (i.e.,

the likelihood of attack has a probability of 1). However, thisgeneral credible threat should not be confused with the likelihood of a successful terrorist action (i.e., the probability of a successful attack is <1). Generally in NEPA analysis, the NRC must consider reasonable foreseeable impacts including those from potential accidents. Due to the unique nature of terrorist activities the following discussion focuses on the qualitative probability of a successful attack because at this time it is only possible to assign qualitative probabilities to these events."

The Diablo EA Supplement draws no distinction between the probability of an attack and the conditional probability that the attack will be successful. The Supplement does not indicate whether a "credible" threat or a "plausible" threat is, or is not, equivalent to a "successful attack". From the Pa'ina EA Appendix, one might infer that the "plausible" threats described in the Diablo EA Supplement are thought (by the Staff) to have a comparatively high conditional probability of success. The Supplement provides no clarity on these points.

The Supplement does not provide any framework or terminology for discussing probability in qualitative terms. The Supplement does not discuss the conditional probabilities of radiological impacts and other outcomes of assumed attack scenarios, thereby ignoring an opportunity to partially quantify malice-related risks. Overall, the Supplement provides an inconsistent and incomplete treatment of the probability of attack.

Role of emergency planning The Diablo EA Supplement states (at page 6) that the NRC has "developed emergency planning requirements, which could mitigate potential [radiological] consequences for certain [attack] scenarios [at an ISFSI]". No further explanation is provided, and no document is cited. This statement apparently refers to security-related enhancements that licensees have made in their emergency preparedness (EP) programs, pursuant to

Assessing Risks of PotentialMalicious Actions at Commercial NuclearFacilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 32 communications from the NRC. These enhancements are not required by current NRC regulations. The NRC Staff has, therefore, sought "Commission approval to begin activities to develop a new voluntary performance-based EP regulatory regimen that could serve as an alternative approach to existing EP regulations and guidance". 66 From that information, one can infer that the Diablo EA Supplement assumes that voluntary EP enhancements would reduce malice-related risks at the Diablo Canyon ISFSI. The Supplement states (at page 7): "In some situations, emergency planning actions could provide an additional measure of protection to help mitigate the consequences, in the unlikely event that an attack were attempted at the Diablo Canyon ISFSI". Apparently, those emergency planning actions would involve voluntary, security-related enhancements.

The NRC Staffs lack of clarity in the Supplement regarding the role of emergency planning illustrates the negative effects of an entrenched culture of secrecy. Effective emergency response requires rapid, coordinated actions by many public and private entities that normally have limited or no engagement with the NRC and the licensee.

Secrecy in emergency planning will almost guarantee that confusion and delay would prevail in an actual emergency. Moreover, emergency planning for reactor sites is not currently optimized to address land contamination, which would be the dominant source of radiological impacts following a successful attack on an ISFSI.

Considerationof other nuclearfacilities at the Diablo Canyon site The Diablo EA Supplement does not discuss risk-related interactions among the proposed ISFSI and other nuclear facilities at the Diablo Canyon site. The Supplement does not mention the cumulative risks arising from operation of all the nuclear facilities at the site.

Section 3.2, above, explains the importance of: (i) considering risk-related interactions among nuclear facilities at a site; and (ii) assessing the cumulative risks from operation of 67 those facilities.

4.2 Threat Scenarios and Radiological Impacts Considered by the Staff The Diablo EA Supplement provides (at page 6) brief descriptions of: (i) the type of spent-fuel storage module that would be employed at the Diablo Canyon ISFSI; and (ii) the module's purported robustness against attack. The module would function as follows.

Spent fuel assemblies would be stored vertically inside a sealed, cylindrical, multi-purpose canister (MPC) made of stainless steel, which would in turn be located inside an overpack. The overpack would consist of two, coaxial, cylindrical, carbon steel shells separated by a layer of concrete, with a fixed baseplate at the bottom and a removable lid at the top. The overpack would be penetrated by cooling vents at its top and bottom, whose purpose would be to allow a flow of ambient air over the outer surface of the MPC, driven by natural convection, to remove radioactive decay heat from the fuel, 66 Reyes, 2006, page 1.

67 Related information is provided in: Thompson, 2002.

Assessing Risks of PotentialMaliciousActions at Commercial NuclearFacilities:

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 33 assemblies. The module would be supplied by Holtec International. This type of module is known as the HI-STORM 100SA System.

To assess the potential for release of radioactive material from a Diablo Canyon module by malicious actions, the NRC Staff relied on generic security assessments for ISFSIs, apparently conducted around 2002. The Diablo EA Supplement states (at page 7):

"Plausible threat scenarios considered in the generic security assessments for ISFSIs included a large aircraft impact similar in magnitude to the attacks of September 11, 2001, and ground assaults using expanded adversary characteristics consistent .with the design basis threat for radiological sabotage for nuclear power plants." The Supplement later (at page 7) describes these two attack scenarios as "the most severe plausible threat scenarios". Section 4.3, below, addresses the merit of that statement.

The Diablo EA Supplement does not provide any analysis of the radiological impacts of threat scenarios, nor does it cite any document that provides such analysis. The Supplement does not provide any estimate of the radiation dose arising from release of radioactive material, except to say (at page 7) that the dose "would likely be below 5 rem" at the Diablo Canyon site. The Supplement strongly implies that the generic ISFSI assessments yielded the same upper range of dose. That would be consistent with the licensing role of the generic ISFSI assessments, because a dose of 5 rem is the maximum allowable dose for a design-basis accident at an ISFSI.6 8 Obtaining a dose of 5 rem would require only a small release of radioactive material from a storage module. Table 4-1 illustrates this point. It shows, for example, that creation of a hole in an MPC with an equivalent diameter of 2.3 mm would yield a dose of 6.3 rem.

Most of that dose would be attributable to release of two-millionths (1.9E-06) of the MPC's inventory of radioisotopes in the "fines" category. That release corresponds to a comparatively small amount of damage to the MPC and the spent fuel within it. Clearly, therefore, the Diablo EA Supplement has not considered a threat scenario that causes substantial damage to an ISFSI module.

4.3 Threat Scenarios and Radiological Impacts that are Relevant to an ISFSI The NRC Staff has not provided a credible analysis of threat scenarios and radiological impacts for an ISFSI at Diablo Canyon or elsewhere. Some illustrative analysis is provided here, to show deficiencies in the Diablo EA Supplement. Correcting those deficiencies is a task for the NRC Staff. The illustrative analysis provided here is abbreviated due to the author's concern about dissemination of sensitive information. A 68 NRC regulation 10 CFR 72.106(b) limits the radiation dose that any individual located on or beyond the nearest boundary of the controlled area of an ISFSI may receive from any design-basis accident. The dose limit is the more limiting of: (i) a total effective dose equivalent (TEDE) of 5 rem; or (ii) a 50-rem sum of the deep-dose equivalent and the committed dose equivalent to any individual organ. Separate dose limits are also specified for the lens of the eye and for skin or extremities.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 34 much fuller analysis could be provided 69 here, drawing from published literature and general engineering knowledge.

An ISFSI module's vulnerability to attack In some ways, the type of storage module proposed for the Diablo canyon ISFSI (the HI-STORM IOOSA System) is a robust structure. The overpack has an outer diameter of 3.7 meters and a height of 5.9 meters. Its outer, carbon steel shell is about 3/4 inch (2 cm) thick, the inner shell is about 11/4 inch (3 cm) thick, and the space between these shells is filled by about 27 inches (69 cm) of concrete (details vary by module version).70 That is a robust structure in terms of its resistance to natural forces (e.g., tornado-driven missiles), but not in terms of its ability to withstand penetration by weapons available to sub-national groups. In any event, the overpack is already penetrated by cooling vents, as described above. The cylindrical wall of the MPC is about 1/2 inch (1.3 cm) thick, and could be readily penetrated by available weapons. The spent fuel assemblies that would be stored inside the MPC are composed of long, narrow tubes made of zirconium alloy, inside which uranium oxide fuel pellets are stacked. The walls of the tubes (the fuel cladding) are about 0.023 inch (0.6 mm) thick and have negligible capacity to withstand penetration by available weapons. Moreover, zirconium is a flammable metal. In finely divided form, it is used in military incendiary devices.

A competent, sub-national group seeking to create offsite radiological impacts by attacking a storage module at the Diablo Canyon ISFSI would probably seek to penetrate the wall of the MPC and ignite the zirconium fuel cladding, with the intent of initiating a fire that would release radioactive material to the atmosphere. A fire could release a substantial fraction of the cesium-137 in affected fuel assemblies, because cesium is a volatile element. The presence of cooling vents at the top and bottom of the module could create a chimney effect that enhances a zirconium fire. For that reason, the attackers could prefer that the module remains upright. The type of module (HI-STORM lOOSA System) that the licensee intends to use at the Diablo Canyon ISFSI would remain upright during many attack scenarios, because it is specifically designed to be anchored to its pad. The attackers could seek to exacerbate a fire by enlarging the cooling vents or creating additional holes in the overpack.

Instruments and modes of attack Penetration of the overpack of a storage module (and penetration of the MPC) could be readily accomplished using a shaped charge. 7 1 These devices have many civilian applications. They are extensively used in the mining and petroleum industries, and for demolition. They have been used in military contexts for decades. Their military applications include, for example, human-carried demolition charges or warheads for anti-tank missiles. Construction and use of shaped charges does not require assistance 69 Related information is provided in: Thompson, 2005b; Thompson, 2003.

70 Holtec FSAR, Chapter 1.

71Walters, 2003.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 35 from a government or access to classified information. Many people around the world have experience with these devices in civilian and military contexts.

Table 4-2 provides some information about the shaped charge as a potential instrument of attack. A shaped charge described in that table was designed to penetrate large thicknesses of rock or concrete, as the first stage of a "tandem" warhead (two devices in line, with differing functions). Detailed information about this device has been openly published, but the citation is not provided here. A test proved that the device could create a hole of 25 cm diameter in rock to a depth of almost 6 meters. A device of that size and capability would not be needed to penetrate an ISFSI module. For that application, competent attackers would employ smaller shaped charges, optimized for portability and diameter and depth of hole.

Penetration using a shaped charge would not be the attackers' only option for creating additional holes in the overpack. For example, attackers could use small charges or cutting devices to sever the bolts holding down the lid of the overpack, and then use charges to remove the lid. Boring into or cutting off portions of the overpack could be accomplished using a thermic lance. That device is an iron pipe through which oxygen gas is passed. When the tip is ignited, iron and oxygen react exothermically at a temperature of about 4,000 degrees C. This lance will easily cut through concrete, which melts at 1,800-2,500 degrees C. Steel plates or reinforcing bars will feed the iron-oxygen reaction. This device was developed in France after World War II, to assist the demolition of submarine pens and other large concrete structures that had been built by Nazi Germany. A thermic lance could readily penetrate the MPC in an ISFSI module and ignite the zirconium fuel cladding inside the MPC.

There are various military situations in which attackers seek to penetrate a target (e.g., an armored vehicle, or a concrete bunker) and initiate combustion inside the target. If the attackers achieve direct contact with the target, they might pursue this goal in two, separate steps. First, the target would be penetrated. Second, an incendiary device or material would be inserted through the resulting hole. Often, however, the attack would be made from a distance. For example, an anti-tank missile might be launched from a point tens or hundreds of meters from the target. To accommodate such situations, weapons laboratories and suppliers have developed warheads that combine penetration and incendiary functions. One arrangement is a tandem warhead in which the first stage penetrates the target and the second stage is an incendiary device. A variant of this arrangement employs a "thermobaric" second stage that generates blast and thermal effects.

An attack on the Diablo Canyon ISFSI could be mounted in three different modes, or in combinations of those modes. 72 First, attackers could seek to place themselves in direct contact with ISFSI modules. That mode of attack could involve the use of land vehicles 72 Each mode of attack on the ISFSI could be accompanied by diversionary or complementary attacks at other locations.

Assessing Risks of PotentialMaliciousActions at CommercialNuclearFacilities.-

The Case of a ProposedISFSI at the Diablo Canyon Site Page 36 or airborne vehicles (which could include helicopters or ultralight aircraft) to carry personnel to the ISFSI. Second, attackers could fire guided missiles or other weapons at the ISFSI from ground positions, land vehicles, airborne vehicles, or boats located at distances of hundreds of meters or more from the ISFSI. In illustration of the potential for such an attack, note that the TOW (tube-launched, optically-tracked, wire-guided) missile, which is widely used around the world and which has a proven capability against armored vehicles and bunkers, has a range exceeding 3,000 meters. Third, attackers could use aircraft as improvised cruise missiles, in a kamikaze or remotely-guided configuration.

The Diablo EA Supplement considers the third mode of attack on an ISFSI, but makes the mistaken assumption that a large, fuel-laden commercial aircraft would pose the greatest threat using this attack mode. Large, commercial aircraft caused major damage to the World Trade Center and the Pentagon in September 2001, but they would not be optimal as instruments of attack on an ISFSI. They are comparatively soft objects containing a few hard structures such as turbine shafts. They can be difficult to guide precisely at low speed and altitude. A competent group seeking to attack an ISFSI using an improvised cruise missile would probably prefer to use a smaller, general-aviation aircraft laden with explosive material, perhaps configured as a shaped charge in tandem with incendiary material. In this connection, note that the US General Accounting Office (GAO) expressed concern, in September 2003 testimony to Congress, 73 about the potential for malicious use of general-aviation aircraft. The testimony stated:

"Since September 2001, TSA [the Transportation Security Administration]

has taken limited action to improve general aviation security, leaving it far more open and potentially vulnerable than commercial aviation. General aviation is vulnerable because general aviation pilots are not screened before takeoff and the contents of general aviation planes are not screened at any point. General aviation includes more than 200,000 privately owned airplanes, which are located in every state at more than 19,000 airports. Over 550 of these airports also provide commercial service. In the last 5 years, about 70 aircraft have been stolen from general aviation airports, indicating a potential weakness that could be exploited by terrorists."

Prudentassumptions about attack Many people around the world are familiar with the attack principles described in the preceding paragraphs, relevant weapons are available in many countries, and the resources required for an attack are attainable by many sub-national groups. It would, therefore, be prudent to assume that: (i) a sub-national group could mount a credible attack on ISFSI modules at Diablo Canyon; (ii) the group would seek to create a release pathway from the interior of one or more MPCs to the atmosphere; (iii) the group would 13 Dillingham, 2003, page 14.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 3 7 seek to initiate a zirconium fire inside each attacked MPC, to maximize the release of radioactive material to the atmosphere; and (iv) the attack could have a substantial conditional probability of success.

Radiologicalimpacts of attack Giventhe second and third of the assumptions in the preceding paragraph, a successful attack on the Diablo Canyon ISFSI could release to the atmosphere a substantial fraction (tens of percent) of the cesium-137 in each attacked MPC, together with releases of other radioisotopes. 74 Several MPCs could be affected in this manner. Section 2.3, above, discusses a postulated release of 3 million Curies of cesium-137, representing about 50 percent of the cesium-137 in four spent-fuel storage modules. That is a reasonable assumption for the purpose of assessing the radiological impacts of a successful attack.

Land contamination and its sequelae would be the dominant radiological impacts of the release from attacked MPCs. Sequelae would include contamination of food and water, cancers and other adverse health effects that would be manifested years after the release, relocation of populations, abandonment of real estate, and various economic and social impacts. An estimate of economic loss arising from an atmospheric release of 3.5 million Curies of cesium-137, considering five US reactor sites, shows an average loss of $91 billion.75 Factors not considered in that estimate could lead to a higher economic loss.

The radiological impacts of potential atmospheric releases from power reactors have been studied for decades. For example, the 1975 Reactor Safety Study discussed these impacts in detail.76 Studies show that a release from a power reactor could lead to early fatalities among downwind populations. The fatalities would be "early" in the sense that they would be manifested within a few weeks or months after the release. Early fatalities would be almost entirely attributable to the release of short-lived radioisotopes, which are present in abundance in the core of an operating reactor. An ISFSI would contain a negligible inventory of short-lived radioisotopes, because it would contain spent fuel that has aged over a period of years. Thus, the potential for early fatalities is a highly inappropriate indicator of the radiological impacts of conventional accidents or attacks at an ISFSI. The NRC Staffs reliance on this indicator in the Diablo EA Supplement provides, by itself, sufficient grounds to reject the conclusions of the Supplement.

4.4 Options for Reducing the Risks of Malicious Actions The Diablo EA Supplement provides (at page 3) a limited discussion of alternatives to the proposed ISFSI. These alternatives fall into three categories: (i) shipment of spent fuel offsite; (ii) other methods of storing spent fuel onsite; and (iii) no action, leading to shutdown of the Diablo Canyon reactors. In discussing other methods of storing spent 14 The fractional release of each radioisotope would be determined by the isotope's physical and chemical properties as an element.

75 Beyea et al, 2004.

76 NRC, 1975, Appendix VI.

Assessing Risks of PotentialMaliciousActions at Commercial NuclearFacilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 38 fuel onsite, the Supplement considers an increase in the capacity of the existing spent-fuel pools at the site, or construction of a new pool, and rejects both options. The Supplement does not discuss the option of constructing the ISFSI using a design that is more robust against attack than the design proposed by the licensee.

The Supplement does not mention the NationalInfrastructureProtectionPlan. It does not discuss homeland-security strategy, the principles of protective deterrence, or the opportunities that the NIPP has identified for incorporating protective features into the design of infrastructure elements.

Increasingthe ISFSTs robustness againstattack Options for designing a Diablo Canyon ISFSI to be more robust against attack have been identified by this author, as follows: 77 "re-design of the ISFSI to use thick-walled metal casks, dispersal of the casks, and protection of the casks by berms or bunkers in a configuration such that pooling of aircraft fuel would not occur in the event of an aircraft impact". Elsewhere, the author has provided a more detailed discussion about designing an ISFSI to be more robust against attack.78 A factor addressed in that discussion is the possibility that society will extend the life of ISFSIs until they become, by default, repositories for spent fuel. Consideration of that possibility could favor an above-ground ISFSI whose robustness would be enhanced through a combination of the design options described above.

Holtec International has developed a design for a new ISFSI storage module that is said to be more robust against attack than present modules. The new module is the HI-STORM 1OOU module, which would employ the same MPC as is proposed for the Diablo Canyon ISFSI. For most of its height, the lOOU module would be underground.

79 Holtec has described the robustness of the 100U module as follows:

"Release of radioactivity from the HI-STORM 1OOU by any mechanical means (crashing aircraft, missile, etc.) is virtually impossible. The only access path into the cavity for a missile is vertically downward, which is guarded by an arched, concrete-fortified steel lid weighing in excess of 10 tons. The lid design, at present configured to easily thwart a crashing aircraft, can be further buttressed to withstand more severe battlefield weapons, if required in the future for homeland security considerations. The lid is engineered to be conveniently replaceable by a later model, if the potency of threat is deemed to escalate to levels that are considered non-credible today."

The design of the Holtec 100U module has been under review by the NRC Staff. The Staff has expressed concern about seismic-related structural analyses performed for this design, and in late 2006 Holtec withdrew its application for a Certificate of Compliance

" Thompson, 2002, paragraph XI-5.

78 Thompson, 2003.

79 Holtec, 2007.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities.-

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 39 for the 100U module. Further discussions were0held between Holtec and the Staff on 27 8

March 2007, described by the Staff as follows:

"At the meeting, Holtec presented new and revised structural analyses in response to the staffs concerns. The staff responded positively to the material presented by Holtec and indicated that it appeared the staffs concerns had been addressed. A new application is scheduled to be submitted by the end of April 2007."

It appears that the Holtec 1OOU module may soon receive a Certificate of Compliance from the NRC. At that point, the IOOU module would be available for use in the Diablo Canyon ISFSI.

Enhancing active defense of the ISFSI As currently proposed, the Diablo Canyon ISFSI would receive an active defense involving the deployment of armed guards and related security measures. That form of defense contrasts with the passive defense provided by a facility's inherent robustness against attack.

Active defense of the ISFSI could be enhanced by employing additional security measures, such as anti-aircraft guns or missiles. The Diablo EA Supplement does not discuss that option. A thorough assessment of malice-related risks at the Diablo Canyon ISFSI should consider the merits of enhancing active defense as a risk-reducing option.

In considering that option, the assessment should recognize that active defense has substantial costs, both monetary and societal, that could be avoided by enhancing the ISFSI's inherent robustness.81 Enhancing capabilitiesfor damage control As discussed in Section 4.3, above, it would be prudent to assume that a group attacking the Diablo Canyon ISFSI would seek to create a release pathway from the interior of one or more MPCs to the atmosphere, and to initiate a zirconium fire inside each attacked MPC in order to maximize the release of radioactive material to the atmosphere. To counter those ambitions, the licensee could improve its capabilities for damage control, seeking to minimize the radioactive release in the event of an attack. Relevant capabilities would include: (i) availability of personnel trained and equipped to work in a high-radiation environment; and (ii) deployment of devices and materials to suppress fires and limit releases of radioactive material. A thorough assessment of malice-related 80 Johnson, 2007, Enclosure C.

81In October 2001 the French government deployed anti-aircraft missiles at the La Hague nuclear site.

Deployment of anti-aircraft guns or missiles to defend the Diablo Canyon ISFSI would require the ongoing presence of US military personnel, to maintain and operate these weapons. Complex questions of command authority for firing of the weapons would need to be addressed. These factors would generate substantial monetary and societal costs.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities:

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 40 risks at the Diablo Canyon ISFSI should consider the merits of enhancing capabilities for damage control as a risk-reducing option.

4.5 An Overall Evaluation of the Staff's Supplement Section 2 of this report provides a broad perspective on potential malicious actions at nuclear facilities. That perspective shows the importance of conducting thorough assessments of malice-related risks and options for reducing those risks. Section 3 sets forth an appropriate framework for assessing malice-related risks, thereby providing a standard for evaluating the Diablo EA Supplement. Sections 4.1 through 4.4 review various aspects of the Supplement. Major findings of the review include:

(i) the Supplement neither provides technical analysis nor cites any document that provides such analysis; (ii) in preparing the Supplement, the NRC Staff relied on an unexplained process to identify plausible threat scenarios; (iii) the Staff failed to consider threat scenarios that are more severe and at least as plausible as the threat scenarios that it did consider; (iv) the Staff relied on a crude, partially explained methodology to assess malice-related risks; (v) the Staff employed a highly inappropriate indicator of the radiological impacts of attacks, namely the potential for early fatalities; (vi) the Supplement greatly under-estimates the scale of radiological impacts of attacks and ignores the dominant impacts, which would arise from land contamination; (vii) the Supplement ignores the NIPP and the potential that it articulates for increasing the inherent robustness of infrastructure facilities against attack; (viii) the Supplement fails to consider options for reducing malice-related risks at the proposed Diablo Canyon ISFSI through measures including the use of more robust fuel storage modules; and (ix) the Supplement fails to consider ISFSI-related risks in the context of risks associated with other nuclear facilities on the Diablo Canyon site.

These are grave deficiencies. The Diablo EA Supplement is not credible.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities.-

The Case of a ProposedISFSI at the Diablo Canyon Site Page 41

5. Conclusions Major conclusions of this report are as follows:

C1. It would be prudent to assume that power reactors, spent-fuel pools and ISFSIs in the US will be attacked by capable sub-national groups during the coming decades.

C2. Given present designs and defenses of these facilities, there is a substantial probability that an attack by a capable sub-national group would cause a release to the environment of a large amount of radioactive material, yielding severe radiological consequences.

C3. Design options are available that could increase the inherent robustness of commercial nuclear facilities against attack, especially in the case of new facilities such as the proposed Diablo Canyon ISFSI.

C4. Increasing the inherent robustness of infrastructure facilities against attack is envisioned in the NationalInfrastructureProtectionPlan, and would support a national strategy of protective deterrence.

C5. Present methodologies for risk assessment could be adapted to provide operationally-useful assessments of: (i) the risks of malicious actions at commercial nuclear facilities; and (ii) the potential for reducing those risks through alternative options.

C6. The Diablo EA Supplement has grave deficiencies as summarized in Section 4.5, above, and is not credible.

C7. A credible assessment of malice-related risks at the proposed Diablo Canyon ISFSI would correct the deficiencies in the Diablo EA Supplement and would consider a range of risk-reducing options, including design options that enhance robustness of the ISFSI and limits on future production of spent fuel.

Assessing Risks ofPotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 42

6. Bibliography (Adam, 2005)

David Adam, "50m environmental refugees by end of decade, UN warns", The Guardian, 12 October 2005.

(Alvarez et al, 2003)

Robert Alvarez, Jan Beyea, Klaus Janberg, Jungmin Kang, Ed Lyman, Allison Macfarlane, Gordon Thompson and Frank N. von Hippel, "Reducing the Hazards from Stored Spent Power-Reactor Fuel in the United States", Science and Global Security, Volume 11, 2003, pp 1-51.

(ASLB, 1982)

CarolinaPower andLight Co. (Shearon Harris Nuclear Power Plant, Units 1 and 2),

LBP-82-119A, 16 NRC 2069, 2098 (1982).

(Beyea et al, 2004)

Jan Beyea, Ed Lyman and Frank von Hippel, "Damages from a Major Release of Cs-137 into the Atmosphere of the United States", Science and Global Security, Volume 12, 2004, pp 125-136.

(Beyea, 1979)

Jan Beyea, "The Effects of Releases to the Atmosphere of Radioactivity from Hypothetical Large-Scale Accidents at the Proposed Gorleben Waste Treatment Facility",

in: Gordon Thompson et al, PotentialAccidents and Their Effects, Chapter 3 of the report of the Gorleben International Review, submitted to the Government of Lower Saxony (in German), March 1979.

(Brian, 2006)

Danielle Brian, Project on Government Oversight, letter to NRC chair Nils J. Diaz, 22 February 2006.

(Brzezinski, 2007)

Zbigniew Brzezinski, testimony before the US Senate Foreign Relations Committee, 1 February 2007.

(Deller, 2002)

Nicole Deller, "Rule of Power or Rule of Law?", Science for DemocraticAction, Volume 10, Number 4, August 2002.

(DHS, 2006)

US Department of Homeland Security, NationalInfrastructureProtectionPlan (Washington, DC: DHS, 2006).

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 43 (Dillingham, 2003)

Gerald L. Dillingham, US General Accounting Office, testimony before the Committee on Commerce, Science and Transportation, US Senate, "Aviation Security: Progress Since September 11, 2001, and the Challenges Ahead", 9 September 2003.

(DOE, 1987)

US Department of Energy, Health andEnvironmental Consequences of the Chernobyl Nuclear Power PlantAccident, DOE/ER-0332 (Washington, DC: DOE, June 1987).

(ElBaradei, 2004)

Mohamed ElBaradei, Director General, International Atomic Energy Agency, "Nuclear Non-Proliferation: Global Security in a Rapidly Changing World", keynote address, Carnegie International Non-Proliferation Conference, Washington, DC, 21 June 2004.

(Fertel, 2006)

Marvin Fertel, Nuclear Energy Institute, testimony before the Subcommittee on National Security, Emerging Threats and International Relations, US House Committee on Government Reform, 4 April 2006.

(Franceschini and Schaper, 2006)

Giorgio Franceschini and Annette Schaper, Nuclear Weapons Research and Modernization Without Testing: The CTBT in danger? (Frankfurt: Peace Research Institute Frankfurt, 2006).

(Flynn, 2007)

Stephen Flynn, The Edge of Disaster.Rebuilding a ResilientNation (New York: Random House, 2007).

(GAO, 2007)

US Government Accountability Office, Crude Oil: UncertaintyaboutFuture Oil Supply Makes It Important to Develop a Strategy for Addressing a Peakand Decline in Oil Production,GAO-07-283 (Washington, DC: GAO, February 2007).

(Gilman et al, 2007)

Nils Gilman, Doug Randall and Peter Schwartz, Impacts of Climate Change (San Francisco: Global Business Network, January 2007).

(Hannerz, 1983)

K. Hannerz, Towards IntrinsicallySafe Light Water Reactors (Oak Ridge, Tennessee:

Institute for Energy Analysis, February 1983).

(Hart et al, 2002)

Gary Hart and Warren B. Rudman (Co-chairs), Stephen E. Flynn (project director) and Task Force members, America Still Unprepared- America Still in Danger:Report of an

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 44 Independent Task Force Sponsored by the Council on ForeignRelations (New York:

Council on Foreign Relations, 25 October 2002).

(Hebert, 2007)

H. Josef Hebert, Associated Press, "NRC rejects plan for power plants to stop airliner attacks", The Boston Globe, 30 January 2007.

(Hersh, 2006)

Seymour M. Hersh, "The Iran Plans", The New Yorker, 17 April 2006, pp 30-37.

(Hirsch et al, 2005)

Robert L. Hirsch, Roger H. Bezdek and Robert M. Wendling, "Peaking Oil Production:

Sooner Rather Than Later?" Issues in Science and Technology, Volume XXI, Number 3, Spring 2005, pp 25-30. (That paper. was adapted from a report prepared for the US Department of Energy's National Energy Technology Laboratory.)

(Holtec, 2007)

Holtec International, "The HI-STORM 100 Storage System", accessed at

<http://www.holtecinternational.com/hstorml00.html> on 17 June 2007.

(Holtec FSAR)

Holtec International, FinalSafety Analysis Reportfor the Holtec InternationalStorage and Transfer OperationReinforced Module Cask System (HI-STORM 100 Cask System),

NRC Docket No. 72-1014, Holtec Report HI-2002444 (Holtec, undated).

(Johnson, 2007)

Michael R. Johnson, Assistant for Operations, Office of the EDO, NRC Staff, memo to the NRC Commissioners, "Weekly Information Report - Week Ending March 30, 2007",

SECY-07-0067, 6 April 2007.

(Kugler, 1995)

Richard L. Kugler, Toward a Dangerous World: US National Security Strategyfor the Coming Turbulence (Santa Monica, California: RAND Corporation, 1995).

(Kull et al, 2007)

Steven Kull et al, Muslim Public Opinion on US Policy, Attacks on Civiliansand al Qaeda (Maryland: Program on International Policy Attitudes, University of Maryland, 24 April 2007).

(Marshall and Gurr, 2005)

Monty G. Marshall and Ted Robert Gurr, Peace and Conflict 2005, (College Park, Maryland: Center for International Development and Conflict Management, University of Maryland, May 2005).

Assessing Risks of PotentialMalicious Actions at Commercial Nuclear Facilities.

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 45 (MEA, 2005)

Millennium Ecosystem Assessment, Ecosystems and Human Well-Being. Synthesis (Washington, DC: Island Press, 2005).

(Meadows et al, 1972)

Donella H. Meadows, Dennis L. Meadows, Jorgen Randers and William W. Behrens III, The Limits to Growth (London: Earth Island Limited, 1972).

(Meserve, 2002)

Richard A. Meserve, "Nuclear Security in a New World", The IndustrialPhysicist, October/November 2002, pp 20-23.

(National Research Council, 2006)

Committee on the Safety and Security of Commercial Spent Nuclear Fuel Storage, Board on Radioactive Waste Management, National Research Council, Safety and Security of Commercial Spent Nuclear FuelStorage: Public Report (Washington, DC: National Academies Press, 2006). (This document was first released in April 2005.)

(National Research Council, 1990)

National Research Council, Health Effects of Exposure to Low Levels of Ionizing Radiation:BEIR V (Washington, DC: National Academy Press, 1990).

(NRC, 2007a)

US Nuclear Regulatory Commission Staff, Supplement to the EnvironmentalAssessment and Draft Finding ofNo Significant Impact Related to the Constructionand Operation of the Diablo Canyon Independent Spent Fuel Storage Installation,Docket No. 72-26, Pacific Gas and Electric Company, May 2007.

(NRC, 2007b)

US Nuclear Regulatory Commission Staff, Appendix B: Considerationof Terrorist Attacks on the ProposedPa'inaIrradiator,Docket No. 030-36974 (supplemental appendix to the draft environmental assessment issued on 28 December 2006), 1 June 2007.

(NRC, 2007c)

US Nuclear Regulatory Commission, Memorandum and Order, Docket No. 72-26-ISFSI, 26 February 2007.

(NRC, 1994)

US Nuclear Regulatory Commission, "10 CFR Part 73, RIN 31 50-AE8 1, Protection Against Malevolent Use of Vehicles at Nuclear Power Plants", FederalRegister, Volume 59, Number 146, 1 August 1994, pp 38889-38900.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities.

The Case of a ProposedJSFSJ at the Diablo Canyon Site Page 46 (NRC, 1979)

US Nuclear Regulatory Commission, Generic EnvironmentalImpact Statement on Handling and Storage of Spent Light Water Power Reactor Fuel, NUREG-05 75 (Washington, DC: Nuclear Regulatory Commission, August 1979).

(NRC, 1975)

US Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400 (NUREG-75/014) (Washington, DC: Nuclear Regulatory Commission, October 1975).

(Raskin et al, 2002)

Paul Raskin et al, Great Transition: The Promise and Lure of the Times Ahead (Boston, Massachusetts: Stockholm Environment Institute, 2002).

(Reyes, 2006)

Luis A. Reyes, Executive Director for Operations, NRC Staff, memo to the NRC Commissioners, "Results of the Review of Emergency Preparedness Regulations and Guidance", SECY-06-0200, 20 September 2006.

(Scarry, 2002)

Elaine Scarry, "A nuclear double standard", Boston Sunday Globe, 3 November 2002, page D 11.

(Thompson, 2006)

Gordon R. Thompson, Risks and Risk-Reducing Options Associated with Pool Storage of Spent Nuclear Fuel at the Pilgrim and Vermont Yankee Nuclear PowerPlants, a report for the Office of the Attorney General, Commonwealth of Massachusetts (Cambridge, Massachusetts: Institute for Resource and Security Studies, 25 May 2006).

(Thompson, 2005a)

Gordon R. Thompson, Institute for Resource and Security Studies, Cambridge, Massachusetts, direct testimony before the Minnesota Public Utilities Commission regarding an application for a Certificate of Need to establish an ISFSI at the Monticello site, Docket No. E002/CN-05-123, 16 December 2005.

(Thompson, 2005b)

Gordon R. Thompson, Reasonably ForeseeableSecurity Events: Potentialthreats to optionsfor long-term management of UK radioactivewaste, a report for the UK government's Committee on Radioactive Waste Management (Cambridge, Massachusetts: Institute for Resource and Security Studies, 2 November 2005).

(Thompson, 2004)

Gordon Thompson, Institute for Resource and Security Studies, Cambridge, Massachusetts, testimony before the Public Utilities Commission of the State of California regarding Application No. 04-02-026, 13 December 2004. (This testimony,

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities.

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 4 7 prepared for California Earth Corps, addressed the provision of an enhanced defense of Units 2 and 3 of the San Onofre Nuclear Generating Station.)

(Thompson, 2003)

Gordon Thompson, Robust Storage of Spent Nuclear Fuel: A Neglected Issue.of Homeland Security (Cambridge, Massachusetts: Institute for Resource and Security Studies, January 2003).

(Thompson, 2002)

Gordon Thompson, Declaration of 7 September 2002 in support of a petition to the US Nuclear Regulatory Commission by Avila Valley Advisory Council, San Luis Obispo Mothers for Peace, Peg Pinard et al, regarding a license application for an ISFSI at the Diablo Canyon site, Docket No. 72-26.

(Walters, 2003)

William Walters, "An Overview of the Shaped Charge Concept", paper presented at the 11 th Annual ARL/USMA Technical Symposium, 5 and 7 November 2003. (That symposium was sponsored by the Mathematical Sciences Center of Excellence at the US Military Academy (USMA) and hosted by the US Army Research Laboratory (ARL) and USMA.)

(Wells, 2006)

Jim Wells, US Government Accountability Office, testimony before the Subcommittee on National Security, Emerging Threats and International Relations, US House Committee on Government Reform, "Nuclear Power Plants Have Upgraded Security, but the Nuclear Regulatory Commission Needs to Improve Its Process for Revising the Design Basis Threat", 4 April 2006.

(White House, 2006)

The White House, NationalStrategyfor Combating Terrorism (Washington, DC: The White House, September 2006).

(White House, 2002)

The White House, NationalStrategyfor HomelandSecurity (Washington, DC: The White House, July 2002).

(Yergin, 1991)

Daniel Yergin, The Prize: The Epic Questfor Oil, Money and Power (New York: Simon and Schuster, 1991).

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 48 Table 2-1 Public Opinion in Four Muslim Countries Regarding the US- "War on Terrorism" Country Percentage of Respondents Who Think that the Primary Goal of What the US Calls "the War on Terrorism" is to:

Weaken and Achieve Political Protect Itself from Divide the Islamic and Military Terrorist Attacks Religion and its Domination to People Control Middle East Resources Morocco 33 39 19 Egypt 31 55 9 Pakistan 42 26 12' Indonesia 29 24 23 Notes:

(a) Data are from: Steven Kull et al, Muslim Public Opinion on US Policy, Attacks on Civilians and al Qaeda, Program on International Policy Attitudes, University of Maryland, 24 April 2007.

(b) Percentages not shown in each row are "do not know" or "no response".

Assessing Risks of PotentialMalicious Actions at Commercial Nuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 49 Table 2-2 Future World Scenarios Identified by the Stockholm Environment Institute Scenario Characteristics Conventional Worlds Market Forces Competitive, open and integrated global markets drive world development. Social and environmental concerns are secondary.

Policy Reform Comprehensive and coordinated government action is initiated for poverty reduction and environmental sustainability.

Barbarization Breakdown Conflict and crises spiral out of control and institutions collapse.

Fortress World This scenario features an authoritarian response to the threat of breakdown, as the world divides into a kind of global apartheid with the elite in interconnected, protected enclaves and an impoverished majority outside.

Great Transitions Eco-Communalism This is a vision of bio-regionalism, localism, face-to-face democracy and economic autarky. While this scenario is popular among some environmental and anarchistic subcultures, it is difficult to visualize a plausible path, from the globalizing trends of today to eco-communalism, that does not pass through some form of barbarization.

New Sustainability This scenario changes the character of global civilization Paradigm rather than retreating into localism. It validates global solidarity, cultural cross-fertilization and economic connectedness while seeking a liberatory, humanistic and ecological transition.

Source:

Paul Raskin et al, Great Transition: The Promise and Lure of the Times Ahead, Stockholm Environment Institute, 2002.

Assessing Risks of PotentialMaliciousActions at Commercial NuclearFacilities.

The Case of a ProposedISFSI at the Diablo Canyon Site Page 50 Table 2-3 Selected Approaches to Protecting US Critical Infrastructure From Attack by Sub-National Groups, and Some of the Strengths and Weaknesses of these Approaches Approach Strengths Weaknesses Offensive military

• Can deter or prevent

• Can promote growth of operations internationally governments from sub-national groups hostile supporting sub-national to the US, and build groups hostile to the US sympathy for these groups in foreign populations

- Can be costly in terms of lives, money and national reputation International police Can identify and intercept

• Implementation can be cooperation within a legal potential attackers. slow and/or incomplete framework Requires ongoing international cooperation Surveillance and control of - Can identify and intercept

• Can destroy civil liberties, the domestic population potential attackers leading to political, social and economic decline of the nation Active defense of

• Can stop attackers before

• Can involve higher infrastructure facilities they reach the target operating costs (by use of guards, guns,

• Requires ongoing gates, etc.) vigilance

• May require military involvement Resilient design, passive

• Can allow target to - Can involve higher capital defense, and related survive attack without costs protective measures for damage, thereby enhancing infrastructure facilities protective deterrence (as envisioned in the NIPP)

• Can substitute for other protective approaches, avoiding their costs and adverse impacts

• Can reduce risks from accidents, natural hazards, etc.

Assessing Risks of PotentialMalicious Actions at CommercialNuclearFacilities:

The Case of a ProposedISFSJ at the Diablo Canyon Site Page 51 Table 2-4 Estimated Amounts of Cesium-137 in Nuclear Fuel Associated With Diablo Canyon Unit 1 or Unit 2 Category of Nuclear Fuel Amount of Cesium-137 (million Curies)

One spent fuel assembly at discharge from reactor 0.064 (17.5 MWt per assembly, 90% capacity factor, discharge after 44 months, 520 kgU/assembly)

One reactor core at operating equilibrium 6.2 (193 assemblies, av. burnup = 50% of discharge burnup)

One spent-fuel pool at full loading, allowing space 57 for full-core discharge (1,131 assemblies, av. age after discharge = 10 yr)

One ISFSI module at full capacity 1.3 (32 assemblies, av. age after discharge = 20 yr)

Notes:

(a) The radionuclide inventory of Ginna spent fuel batch 16 is estimated in: V.L. Sailor et al, Severe Accidents in Spent Fuel Pools in Support of Generic Safety Issue 82, NUREG/CR-4982, July 1987. From Tables A. 11 and A. 13 of that document, one finds that the inventory of Cs-137 in newly-discharged spent fuel is 3.05 kCi per GWt-day of fission energy yield. For the assumed conditions of a Diablo Canyon fuel assembly at discharge, this inventory is 0.064 MCi. Almost the same result (0.065 MCi) can be obtained by direct calculation, assuming an energy yield of 200 MeV per fission and a Cs-137 fission fraction of 6.0 percent.

(b) The assumed conditions of a Diablo Canyon fuel assembly at discharge are equivalent to a burnup of 41 MWt-days per kgU.

(c) The mass of 1 MCi of Cs-137 is 11 kg.

Assessing Risks of PotentialMalicious Actions at CommercialNuclear Facilities:

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 52 Table 2-5

-Illustrative Inventories of Cesium-137 Case Inventory of Cesium-137 (Curies)

Produced during detonation of a 10-kilotonne 1,800 fission weapon Released to atmosphere during the Chernobyl reactor 2.4 million accident of 1986 Released to atmosphere during nuclear-weapon tests, 20 million primarily in the 1950s and 1960s (Fallout was non-uniformly distributed across the planet, mostly in the Northern hemisphere.)

Currently in reactor core of Diablo Canyon Unit 1 6.2 million-or Unit 2 Currently in spent-fuel pool of Diablo Canyon Unit 1 57 million or Unit 2 In a typical module of a Diablo Canyon ISFSI 1.3 million Notes:

(a) Inventories in the first three rows are from Table 3-2 of: Gordon Thompson, Reasonably ForeseeableSecurity Events: Potentialthreats to optionsfor long-term management of UK radioactivewaste, A report for the UK government's Committee on Radioactive Waste Management, IRSS, 2 November 2005.

(b) Inventories in rows four through six are author's estimates set forth in Table 2-3 of this report.

Assessing Risks ofPotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 53 Table 2-6 Some Potential Modes and Instruments of Attack on a Nuclear Power Plant Attack Mode/Instrument Characteristics Present Defense Commando-style attack

• Could involve heavy Alarms, fences and lightly-weapons and sophisticated armed guards, with offsite tactics backup

- $uccessful attack would require substantial planning and resources Land-vehicle bomb

• Readily obtainable Vehicle barriers at entry

- Highly destructive if points to Protected Area detonated at target Anti-tank missile

• Readily obtainable None if missile launched

• Highly destructive at point from offsite of impact Commercial aircraft

• More difficult to obtain None than pre-9/11

• Can destroy larger, softer targets Explosive-laden smaller

• Readily obtainable None aircraft - Can destroy smaller, harder targets 10-kilotonne nuclear - Difficult to obtain None weapon

• Assured destruction if detonated at target Notes:

This table is adapted from a table, supported by analysis and citations, in: Gordon Thompson, Robust Storage of Spent Nuclear Fuel. A Neglected Issue of Homeland Security, IRSS, January 2003. Later sources confirming this table include:

(a) Gordon Thompson, testimony before the California Public Utilities Commission regarding Application No. 04-02-026, 13 December 2004.

(b) Jim Wells, US Government Accountability Office, testimony before the Subcommiittee on National Security, Emerging Threats and International Relations, US House Committee on Government Reform, 4 April 2006.

(c) Marvin Fertel, Nuclear Energy Institute, testimony before the Subcommittee on National Security, Emerging Threats and International Relations, US House Committee on Government Reform, 4 April 2006.

(d) Danielle Brian, Project on Government Oversight, letter to NRC chair Nils J. Diaz, 22 February 2006.

(e) National Research Council, Safety and Security of CommercialSpent Nuclear Fuel Storage: Public Report, National Academies Press, 2006.

Assessing Risks ofPotentialMalicious Actions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 54 Table 2-7 Potential Sabotage Events at a Spent-Fuel-Storage Pool, as Postulated in the NRC's August 1979 GEIS on Handling and Storage of Spent LWR Fuel Event Designator General Description of Event Additional Details Mode 1

• Between 1 and 1,000 fuel

• One adversary can carry 3 assemblies undergo extensive charges, each of which can damage by high-explosive damage 4 fuel assemblies charges detonated under water - Damage to 1,000 assemblies Adversaries commandeer the (i.e., by 83 adversaries) is a central control room and hold it "worst-case bounding estimate" for approx. 0.5 hr to prevent the ventilation fans from being turned off Mode 2 - Identical to Mode 1 except that, in addition, an adversary enters the ventilation building and removes or ruptures the HEPA filters Mode 3 - Identical to Mode 1 within the

• Adversaries enter the central pool building except that, in control room or ventilation additioii, adversaries breach two building and turn off or disable opposite walls of the building the ventilation fans by explosives or other means Mode 4 - Identical to Mode 1 except that, in addition, adversaries use an additional explosive charge or other means to breach the pool liner and 5-ft-thick concrete floor of the pool Notes:

(a) Information in this table is from Appendix J of: USNRC, Generic EIS on Handling andStorage of Spent Light Water Power Reactor Fuel, NUREG-0575, August 1979.

(b) The postulated fuel damage ruptures the cladding of each rod in an affected fuel assembly, releasing "contained gases" (gap activity) to the pool water, whereupon the released gases bubble to the water surface and enter the air volume above that surface.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedISFSI at the Diablo Canyon Site Page 55 Table 4-1 Estimated Release of Radioactive Material and Downwind Inhalation Dose for Blowdown of the MPC in a Spent Fuel Storage Module Indicator MPC Leakage Area 4 sq. mm 100 sq. mm 1,000 sq. mm (equiv. dia. = (equiv. dia. = (equiv. dia. =

2.3 mm) 11 mm) 36 mm)

Fuel Release Gases 3.OE-01 3.OE-01 3.OE-01 Fraction Crud 1.OE+00 1.OE+00 1.OE+00 Volatiles 2.OE-04 2.0E-04 2.OE-04 Fines 3.OE-05 3.OE-05 3.OE-05 MPC Blowdown Fraction 9.OE-01 9.OE-01 9.OE-01 MPC Escape Gases 1.OE+00 1.OE+00 L.OE+00 Fraction Crud 7.OE-02 5.OE-01 8.0E-01 Volatiles 4.OE-03 3.OE-01 6.OE-01 Fines 7.OE-02 5.OE-01 8.OE-01 Inhalation Dose (CEDE) to a 6.3 rem 48 rem 79 rem Person at a Distance of 900 m Notes:

(a) Estimates are from: Gordon Thompson, EstimatedDownwind InhalationDosefor Blowdown of the MPC in a Spent Fuel Storage Module, IRSS, June 2007.

(b) The assumed multi-purpose canister (MPC) contains 24 PWR spent fuel assemblies with a burnup of 40 MWt-days per kgU, aged 10 years after discharge.

(c) The following radioisotopes were considered: Gases (H-3, 1-129, Kr-85); Crud (Co-60); Volatiles (Sr-90, Ru-106, Cs-134, Cs-137); Fines (Y-90 and 22 other isotopes).

(d) The calculation followed NRC guidance for calculating radiation dose from a design-basis accident, except that the MPC Escape Fraction was drawn from a study by Sandia National Laboratories that used the MELCOR code package.

(e) CEDE = committed effective dose equivalent. In this scenario, CEDE makes up most of the total dose (TEDE) and is a sufficient approximation to it.

(f) The overall fractional release of a radioisotope from fuel to atmosphere is the product of Fuel Release Fraction, MPC Blowdown Fraction, and MPC Escape Fraction.

(g) For a leakage area of 4 square mm, the overall fractional release is: Gases (0.27);

Crud (0.063); Volatiles (7.2E-07); Fines (1.9E-06). Fines account for 95 percent of CEDE, and Crud accounts for 4 percent.

Assessing Risks of PotentialMaliciousActions at CommercialNuclear Facilities:

The Case of a ProposedJSFSI at the Diablo Canyon Site Page 56 Table 4-2 The Shaped Charge as a Potential Instrument of Attack Category of Information Selected Information in Category General information - Shaped charges have many civilian and military applications, and have been used for decades

• Applications include human-carried demolition charges or warheads for anti-tank missiles

• Construction and use does not require assistance from a government or access to classified information Use in World War II The German MISTEL, designed to be carried in the nose of an un-manned bomber aircraft, is the largest known shaped charge

• Japan used a smaller version of this device, the SAKURA bomb, for kamikaze attacks against US warships A large, contemporary

• Developed by a US government laboratory for mounting device in the nose of a cruise missile

• Described in an unclassified, published report (citation is voluntarily withheld here)

- Purpose is to penetrate large thicknesses of rock or concrete as the first stage of a "tandem" warhead

- Configuration is a cylinder with a diameter of 71 cm and a length of 72 cm

- When tested in November 2002, created a hole of 25 cm diameter in tuff rock to a depth of 5.9 m

- Device has a mass of 410 kg; would be within the payload capacity of many general-aviation aircraft A potential delivery - A Beechcraft King Air 90 general-aviation aircraft will vehicle carry a payload of up to 990 kg at a speed of up to 460 km/hr

- A used King Air 90 can be purchased in the US for $0.4-1.0 million Source:

Gordon Thompson, Institute for Resource and Security' Studies, testimony before the Public Utilities Commission of the State of California regarding Application No. 04 026, 13 December 2004.