ML12090A691

NRC Pre-Filed Evidentiary Hearing Exhibit NRC000050 - Chernobyl on the Hudson? the Health and Economic Impacts of a Terrorist Attack at the Indian Point Nuclear Plant

ML12090A691
Person / Time
Site:	Indian Point
Issue date:	09/30/2004
From:	Edwin Lyman Riverkeeper, Union of Concerned Scientists
To:	Atomic Safety and Licensing Board Panel
SECY RAS
Shared Package
ML12090A683	List: ML12090A685 ML12090A686 ML12090A687 ML12090A688 ML12090A689 ML12090A690 ML12090A691 ML12090A692 ML12090A693 ML12090A694 ML12090A695 ML12090A696 ML12090A697 ML12090A698 ML12090A699 ML12090A700
References
RAS 22152, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01
Download: ML12090A691 (54)

Text

CHERNOBYL ON THE HUDSON?

THE HEALTH AND ECONOMIC IMPACTS OF A TERRORIST ATTACK AT THE INDIAN POINT NUCLEAR PLANT Edwin S. Lyman, PhD Union of Concerned Scientists September 2004 Commissioned by Riverkeeper, Inc.

NRC000050 Submitted: March 30, 2012

2 TABLE OF CONTENTS EXECUTIVE

SUMMARY

.................................................................................................4 INTRODUCTION...............................................................................................................7 (a) The terrorist threat to nuclear power plants...............................................................7 (b) The Nuclear Regulatory Commission: an agency in denial.....................................8 (c) The CRAC2 Report.................................................................................................12 ACCIDENTS: DESIGN-BASIS, BEYOND-DESIGN-BASIS, AND DELIBERATE..19 (a) Design-basis accidents.............................................................................................19 (b) Beyond-design-basis accidents................................................................................19 (c) Deliberate accidents.............................................................................................21 THE HEALTH CONSEQUENCES OF A RADIOLOGICAL RELEASE FROM INDIAN POINT................................................................................................................23 THE MACCS2 CODE......................................................................................................26 THE SABOTAGE SCENARIO........................................................................................28 (a) The source term.......................................................................................................28 (b) Meteorology.............................................................................................................33 (c) Protective actions.....................................................................................................35 (d) Population distribution............................................................................................36 RESULTS..........................................................................................................................38 (a) Consequences of radiological exposures during emergency phase.....................39 (b) Doses received by individuals outside of the 10-mile EPZ.....................................42 (i) Thyroid doses to children, their consequences, and the need for KI distribution 42 (ii) Whole-body doses and the need for evacuation or sheltering............................47 (c) Long-term economic and health consequences.......................................................49 (i) EPA Protective Action Guide cleanup standard...................................................49 (ii) Relaxed cleanup standard...................................................................................51 (d) An even worse case................................................................................................52 CONCLUSIONS...............................................................................................................54 ACKNOWLEDGMENTS.................................................................................................54

3 TABLES TABLE 1: NUREG-1465 radionuclide releases into containment for PWRs.................31 TABLE 2: Source term used in MACCS2 model............................................................33 TABLE 3: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs), latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, 100% evacuation of EPZ.........................................................................40 TABLE 4: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs), latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, 24-hour sheltering in EPZ.......................................................................40 TABLE 5: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs), latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, normal activity in EPZ............................................................................41 TABLE 6: Terrorist attack at IP 2, MACCS2 estimates of centerline thyroid doses to 5-year-olds resulting from emergency phase exposures (all doses in rem)..................44 TABLE 7: Terrorist attack at IP 2, MACCS2 estimates of adult centerline whole-body total effective dose equivalents (TEDEs) resulting from emergency phase exposures (all doses in rem).......................................................................................................48 TABLE 8: Terrorist attack at IP 2, MACCS2 95th percentile estimates of early fatalities (EFs) and latent cancer fatalities (LCFs) resulting from emergency phase exposures; 25-mile EPZ..............................................................................................................48 TABLE 9: Terrorist attack at IP 2, MACCS2 estimates of long-term economic and health consequences, EPA intermediate phase PAG (< 2 rem in first year; approx. 5 rem in 50 yrs)............................................................................................................51 TABLE 10: Long-term economic and health consequences of a terrorist attack at IP 2, relaxed cleanup standard (25 rem in 50 years)..........................................................52 TABLE 11: Terrorist attack at IP 2 and 3, MACCS2 estimates of early fatalities (EFs) and latent cancer fatalities (LCFs) resulting from emergency phase exposures, 100%

evacuation of EPZ.....................................................................................................53

4 EXECUTIVE

SUMMARY

Since 9/11, the specter of a terrorist attack at the Indian Point nuclear power plant, thirty-five miles upwind from midtown Manhattan, has caused great concern for residents of the New York metropolitan area. Although the Nuclear Regulatory Commission (NRC) ordered modest security upgrades at Indian Point and other nuclear power plants in response to the 9/11 attacks, the plants remain vulnerable, both to air attacks and to ground assaults by large terrorist teams with paramilitary training and advanced weaponry. Many question whether the NRCs security and emergency planning requirements at Indian Point are adequate, given its attractiveness as a terrorist target and the grave consequences for the region of a successful attack.

This report presents the results of an independent analysis of the health and economic impacts of a terrorist attack at Indian Point that results in a core meltdown and a large radiological release to the environment. We find that, depending on the weather conditions, an attack could result in as many as 44,000 near-term deaths from acute radiation syndrome or as many as 518,000 long-term deaths from cancer among individuals within fifty miles of the plant. These findings confirm that Indian Point poses a severe threat to the entire New York metropolitan area. The scope of emergency planning measures should be promptly expanded to provide some protection from the fallout from an attack at Indian Point to those New York area residents who currently have none. Security at Indian Point should also be upgraded to a level commensurate with the threat it poses to the region.

A 1982 study by Sandia National Laboratories found that a core meltdown and radiological release at one of the two operating Indian Point reactors could cause 50,000 near-term deaths from acute radiation syndrome and 14,000 long-term deaths from cancer.

When these results were originally disclosed to the press, an NRC official tried to reassure the public by saying that the kind of accident the study considered would be less likely than a jumbo jet crashing into a football stadium during the Superbowl.

In the post-9/11 era, the possibility of a jumbo jet crashing into the Superbowl --- or even a nuclear power plant --- no longer seems as remote as it did in 1982. Nonetheless, NRC continues to argue that the 1982 Sandia report is unrealistic because it focused on worst-case accidents involving the simultaneous failure of multiple safety systems, which are highly unlikely to occur by chance. But when the potential for terrorist attacks is considered, this argument no longer applies. Worst-case scenarios are precisely the ones that terrorists have in mind when planning attacks.

Both NRC and Entergy, the owner of Indian Point, assert that even for the most severe terrorist attack, current emergency plans will be adequate to protect residents who live in the evacuation zone within 10 miles of the plant. They also say that there will be no significant radiological impact on New York City or any other location outside of the 10-mile zone. Accordingly, NRC has opposed proposals made after 9/11 to extend the emergency planning zone around Indian Point. However, NRC and Entergy have not

5 provided the public with any documentation of the assumptions and calculations underlying these claims.

In view of the lack of public information available on these controversial issues, we carried out an independent technical analysis to help inform the debate. Our calculations were performed with the same state-of-the-art computer code that NRC uses to assess accident consequences. We used the NRCs guidance on the radiological release from a core meltdown, current estimates of radiation risk, population data from the 2000 census, and the most recent evacuation time estimate for the 10-mile Indian Point emergency planning zone. Following the format of the 1982 Sandia report, we calculated the numbers of near-term deaths from acute radiation syndrome, the numbers of long-term deaths from cancer, and the maximum distance at which near-term deaths can occur. We evaluated the impact of both evacuation and sheltering on these outcomes. We also estimated the economic damages due to the long-term relocation of individuals from contaminated areas, and the cost of cleanup or condemnation of those areas.

The health and environmental impacts of a large radiological release at Indian Point depend strongly on the weather conditions. We have carried out calculations for over 140,000 combinations of weather conditions for the New York area and wind directions for the Indian Point site, based on a years worth of weather data. For this data set, we have determined the average consequences, the peak consequences, and the consequences for 95th percentile weather conditions (in other words, only 5% of the weather sequences analyzed resulted in greater consequences).

We believe that the 95th percentile results, rather than the average values, represent a reasonable assessment of the likely outcome of a successful terrorist attack, since such attacks would most likely not occur at random, but would be timed to coincide with weather conditions that favor greater casualties. Attacks capable of causing the peak consequences that we calculate would be difficult to achieve because of inaccuracies in weather forecasts, restricted windows of opportunity and other factors, but remain within the realm of possibility.

For a successful attack at one of the two operating Indian Point reactors, we find that

• The number of near-term deaths within 50 miles, due to lethal radiation exposures received within 7 days after the attack, is approximately 3,500 for 95th percentile weather conditions, and approximately 44,000 for the worst case evaluated.

Although we assumed that the 10-mile emergency planning zone was entirely evacuated in these cases, this effort was inadequate because (according to Entergys own estimate) it would take nearly 9.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to fully evacuate the 10-mile zone, whereas in our model the first radiological release occurs about two hours after the attack.

• Near-term deaths can occur among individuals living as far as 18 miles from Indian Point for the 95th percentile case, and as far as 60 miles away in the worst case evaluated. Timely sheltering could be effective in reducing the number of

6 near-term deaths among people residing outside of the 10-mile emergency planning zone, but currently no formal emergency plan is required for these individuals.

• The number of long-term cancer deaths within 50 miles, due to non-acutely lethal radiation exposures within 7 days after the attack, is almost 100,000 for 95th percentile weather conditions and more than 500,000 for the worst weather case evaluated. The peak value corresponds to an attack timed to coincide with weather conditions that maximize radioactive fallout over New York City.

• Based on the 95th percentile case, Food and Drug Administration guidance would recommend that many New York City residents under 40, and children in particular, take potassium iodide (KI) to block absorption for radioactive iodine in the thyroid. However, there is no requirement that KI be stockpiled for use in New York City.

• The economic damages within 100 miles would exceed $1.1 trillion for the 95th percentile case, and could be as great as $2.1 trillion for the worst case evaluated, based on Environmental Protection Agency guidance for population relocation and cleanup. Millions of people would require permanent relocation.

We hope that this information will be useful to Federal, State and local homeland security officials as they continue to develop plans to protect all those at risk from terrorist attacks in the post-9/11 world.

7 INTRODUCTION (a) The terrorist threat to nuclear power plants Public concern about the vulnerability of nuclear power plants to catastrophic acts of sabotage soared in the aftermath of the September 11 terrorist attacks. There is ample justification for this concern.

Soon after the 9/11 attacks, the Nuclear Regulatory Commission conceded that U.S.

nuclear power plants were not designed to withstand the high-speed impact of a fully fueled, modern passenger jet. The report of the 9/11 Commission has revealed that al Qaeda considered attacks on nuclear plants as part of their original plan, but declined to do so primarily because of their mistaken belief that the airspace around nuclear power plants in the U.S. was restricted, and that planes that violated this airspace would likely be shot down before impact.1 But al Qaeda is surely now aware that no such restrictions were in place on 9/11. And it is clear from press reports that even today, no-fly zones around nuclear plants are imposed only at times of elevated threat level, and are limited in scope to minimize their economic impact on the aviation industry. This policy reflects a confidence in the ability of the intelligence community to provide timely advance warning of a surprise attack that

--- given the 9/11 example --- is not entirely warranted. Moreover, even when no-fly zones are in place around nuclear plants, they are not likely to be effectively enforced.

For instance, the U.S. government does not require that surface-to-air anti-aircraft protection be provided at nuclear plants, although such defenses have been routinely employed in Washington, D.C. since the 9/11 attacks.

In addition to the aircraft threat, many have begun to question the adequacy of physical security at nuclear plants to protect against ground-based, paramilitary assaults, in view of revelations that thousands of individuals received sophisticated training in military tactics at al Qaeda camps in Afghanistan. Press reports have documented many security failures at nuclear plants around the country, and have called attention to the troubling statistic that during a series of security performance tests in the 1990s, guard forces at nearly 50% of US plants failed to prevent mock terrorist teams from simulating damage that would have caused meltdowns had they been real attacks. This information, which was widely available but largely ignored before 9/11, suddenly became far more alarming in the new threat environment.

Today, the danger of a terrorist attack at a nuclear power plant in the United States ---

either from the air or from the ground --- is apparently as great as ever. According to a January 14, 2004 speech by Robert L. Hutchings, Chairman of the National Intelligence Council (NIC),2 1 The 9/11 Commission Report, Authorized Edition, W.W. Norton, New York, 2004, p. 245.

2 Robert L. Hutchings, Terrorism and Economic Security, speech to the International Security Management Organization, Scottsdale, AZ, January 14, 2004.

8 targets such as nuclear power plants are high on al Qaidas targeting list as a way to sow panic and hurt our economy The group has continued to hone its use of transportation assets as weapons although we have disrupted several airline plots, we have not eliminated the threat to airplanes. There are still al Qaida operatives who we believe have been deployed to hijack planes and fly them into key targets Al Qaidas intent is clear. Its capabilities are circumscribed but still substantial. And our vulnerabilities are still great.

More recently, the 9/11 Commission concluded that major vulnerabilities still exist in cargo and general aviation security. These, together with inadequate screening and access controls, continue to present aviation security challenges.3 (b) The Nuclear Regulatory Commission: an agency in denial Since 9/11, members of the public, non-profit groups and lawmakers across the United States have been calling for major security upgrades at nuclear power plants, including consideration of measures such as military protection against ground assault and anti-aircraft defenses against jet attack. Yet the response of the Nuclear Regulatory Commission (NRC), the agency that regulates both the safety and security of US nuclear reactors, has not been commensurate with the magnitude of the threat.4 And the Department of Homeland Security, the agency charged with coordinating the defense of the entire US critical infrastructure against terrorist attacks, appears to be merely following NRCs lead.5 Notwithstanding a steady stream of FBI warnings citing nuclear power plants as potential terrorist targets, NRC continues to maintain that there is no need to consider measures that could reduce the vulnerability of nuclear plants to air attack. NRCs position is that the best approach to dealing with threats from aircraft is through strengthening airport and airline security measures.6 As it became clear that NRC was not going to require the nuclear industry to protect nuclear plants from attacks on the scale of September 11, some groups began calling for plants to be shut permanently. Because many of the most dangerous fission products in a nuclear reactor core decay rapidly after shutdown, the health consequences of a terrorist attack on a shutdown nuclear reactor would be significantly lower than those of an attack on an operating reactor.7 3 9/11 Commission Report (2004), op cit., p. 391.

4 D. Hirsch, D. Lochbaum and E. Lyman, NRCs Dirty Little Secret, Bulletin of the Atomic Scientists, May/June 2003.

5 E. Lyman, Nuclear Plant Protection and the Homeland Security Mandate, Proceedings of the 44th Annual Meeting of the Institute of Nuclear Materials Management, Phoenix, Arizona, July 2003.

6 US Nuclear Regulatory Commission, Frequently Asked Questions About NRCs Response to the 9/11/01 Events, revised March 15, 2004. On the NRC web site: http://www.nrc.gov/what-we-do/safeguards/911/faq.html#3.

7 Calculations by the author, using the computer code MACCS2, indicate that for an attack occurring at twenty days after reactor shutdown and resulting in core melt and loss of containment, the number of early fatalities from acute radiation sickness would be reduced by 80% and the number of latent cancer fatalities

9 Public concern has been greatest for those plants seen as prime terrorist targets because of their symbolic importance or location near large population and commercial centers, such as the Indian Point nuclear power plant in Westchester County, New York, whose two operating reactors are situated only 24 miles from the New York City limits, 35 miles from midtown Manhattan and in close proximity to the reservoir system that supplies drinking water to nine million people. The post-9/11 movement to shut down Indian Point has attracted a level of support from the public and elected officials not seen since the early 1980s, including calls for shutdown by over 400 elected officials and over 50 municipalities.

In response to this challenge, NRC, Entergy (the owner of Indian Point), other nuclear utilities, and their trade group in Washington, the Nuclear Energy Institute (NEI), have undertaken a massive public relations campaign to assuage public fears about the risk of terrorism at Indian Point. First, they assert that a combination of robust nuclear plant design, physical security and redundant safety measures would be able to stop any terrorist attack from causing significant damage to the reactor core. Second, they argue that even if terrorists were to successfully attack Indian Point and cause a large radiological release, the public health consequences could be successfully mitigated by execution of the emergency plans already in place for residents within the 10-mile-radius emergency planning zone (EPZ). And third, they claim that outside of the 10-mile EPZ, exposures would be so low that no special precautions would be necessary to adequately protect the public from radiation, other than possible interdiction of contaminated produce and water.8 A typical example of the third argument can be found in a recent letter the NRC sent to Alex Matthiessen, Executive Director of Riverkeeper:9 Outside of 10 miles, direct exposure is expected to be sufficiently low that evacuation or sheltering would not be necessary. Exposure to a radioactive plume would not likely result in immediate or serious long-term health effects.

Consideration of public sheltering and evacuation in emergency plans is very conservative and recommended at very low dose levels, well below the levels where health effects would be expected to occur.

resulting from lower exposures would be reduced by 50%, compared to an attack when the reactor is operating at full power. This calculation does not consider an attack on the storage pools for the highly radioactive spent fuel, which could result in significant long-term radiological contamination over a wide area and enormous economic consequences. For an extensive discussion of this threat, as well as an analysis of approaches for mitigating it, see R. Alvarez et al., Reducing the Hazards from Stored Spent Power-Reactor Fuel in the United States, Science and Global Security 11 (2003) 1-51.

8 The NRC defines two emergency planning zones, or EPZs. The 10-mile plume exposure EPZ is the region where evacuation or other actions could be ordered to protect the public from coming into contact with an atmospheric release of radioactivity. The 50-mile ingestion EPZ is the region where interdiction of agricultural products and water supplies could be ordered to prevent the consumption of contaminated produce. No evacuation planning is required for individuals residing within the ingestion EPZ but outside of the plume exposure EPZ.

9 Letter from Cornelius F. Holden, Jr., Office of Nuclear Reactor Regulation, US NRC, to Alex Matthiessen, Riverkeeper, September 30, 2003.

10 The purpose of this report is to address these three claims, with an emphasis on the second and third, by conducting a quantitative assessment of the potential consequences of a terrorist-induced radiological release at Indian Point for individuals both within and without the 10-mile EPZ, including residents of New York City.

There is a considerable need today for an independent study of these questions. At a time when the importance of rigorous emergency planning for catastrophic terrorist attacks is obvious, it is essential that responsible officials be fully apprised of the facts, especially if they contradict long-held assumptions and biases. The lives of many people could be put at jeopardy if emergency plans are not designed with the most accurate information at hand.

This means, in particular, that the emergency planning process should be designed to account for the full spectrum of potential consequences, including so-called fast-breaking release scenarios in which radioactive releases to the environment would begin within about thirty minutes after an attack. This was one of the major conclusions of the report carried out for the government of New York State by James Lee Witt Associates.10 Certain terrorist attack scenarios could be capable of causing such rapid releases.

But NRC and the Federal Emergency Management Agency (FEMA) continue to be reluctant to require testing of fast-breaking radiological releases in emergency planning exercises, asserting that such events are highly unlikely to occur.11 However, this argument is no longer relevant in an age when terrorists have acquired unprecedented levels of technical expertise, and are actively targeting critical infrastructure facilities with the intent to maximize casualties and economic damages. If current emergency plans cannot successfully cope with all credible terrorist-induced events, they should be upgraded. If upgrading to a sufficiently protective level is so cumbersome as to be practically impossible, then other options, including plant shutdown, should not be ruled out.

Members of the public deserve to be fully informed of the potential consequences for their health and property of a successful terrorist attack at Indian Point, so that they can prepare for an attack in accordance with their own judgment and willingness to accept risk. This principle is consistent with the guidance of the Department of Homeland Security, whose Web site www.ready.gov advises that all Americans should begin a process of learning about potential threats so we are better prepared to react during an attack. Sources of technical information other than NRC and the nuclear industry are 10 James Lee Witt Associates, Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone, March 2003, Executive Summary, pg. x.

11 Although it was anticipated that the widely publicized June 8, 2004 emergency planning exercise at Indian Point would involve a fast-breaking release, NRC in fact chose a scenario in which no release at all occurred. It was assumed that terrorists attacked the plant with a jet aircraft but missed the reactor and only managed to crash into the switchyard, causing a loss of off-site power but not enough damage to result in a radiological release. Thus the exercise provided no information as to the effectiveness of the Indian Point emergency plan in protecting residents of the EPZ from injury had the plane actually hit its target and initiated the damage scenario that is assessed in this report.

11 also essential to facilitate a factually accurate and honest discussion of the risks and benefits of continued operation of Indian Point in the post-9/11 era.

Some observers may criticize the public release of this report as irresponsible because they believe it (1) could assist terrorists in planning attacks, or (2) could interfere with the successful execution of emergency plans by unnecessarily frightening members of the public who the authorities claim are not at risk.

We are acutely aware of such concerns and, after careful consideration, have concluded that they do not have merit. We have reviewed this report carefully and omitted any information specific enough to be useful to terrorists seeking to attack Indian Point.

Unfortunately, far more detailed information about nuclear plant design, operation and vulnerabilities than this report contains has already been --- and continues to be --- widely disseminated. For example, a paper written by staff of the Oak Ridge National Laboratory (ORNL) and the Defense Threat Reduction Agency (DTRA), published in 2004 in a technical journal and available on the Internet, contains a diagram of a generic nuclear power plant indicating where truck bombs of various sizes could be detonated in order to stage an attack with a 100% probability of core damage.

There can be little doubt that al Qaeda and other terrorist organizations are already well aware of the severity of the consequences that could result from an attack at Indian Point.

It is NRC and FEMA that seem not to appreciate this risk, and it is to them above all that we direct this study. We also believe that there is a considerable cost, but no apparent benefit, to withholding information that could help people to protect themselves in the event of a terrorist attack at Indian Point. Better information will enable better coordination of all populations at risk and help to avoid situations where some individuals take inappropriate actions that endanger others.

This report would not have been necessary had we seen any indication that NRC and other government authorities fully appreciate the seriousness of the risk to the public from radiological sabotage, or if certain members of the Nuclear Regulatory Commission had not made statements regarding severe accident consequences and risks that contradicted the results of quantitative analyses developed and refined over several decades by NRCs own technical staff and contractors.

For instance, at a recent briefing on NRCs emergency preparedness program, NRC Commissioner Edward McGaffigan, comparing the radiological exposure from a reactor accident to air travel, radon and other sources of exposure to natural radioactivity, said that12 the order of magnitude of the release is similar to all of these other things in peoples lives and they should not panic over a few hundred millirem or even a couple of rem but its this radiation phobia, absolutely inflamed by these anti-12 US NRC, Briefing on Emergency Preparedness Program Status, Public Meeting, September 24, 2003, transcript, p. 73.

12 nuclear groups putting out their misinformation that actually hurts emergency planning Commissioner McGaffigans statement is misleading on at least three counts:

(1) Current emergency planning guidance is already based on the principle that exposures of a couple of rem would be acceptable following a large radiological release; (2) The potential doses from a large radiological release can greatly exceed a few hundred millirem or even a couple of rem far downwind of the release site, and for many individuals could result in a significant increase in their lifetime risk of cancer (10% or greater) or even pose a risk of severe injury or death from acute radiation exposure; (3) Even if the average dose resulting from a large release were on the order of a couple of rem, the total collective detriment (latent cancer fatalities and economic damages) could be very high if a large number of people in a densely populated area were so affected.

We believe that misinformation originating within NRC itself is the biggest obstacle to development of the robust radiological emergency planning strategies needed to cope with todays heightened threat. Statements like those cited above raise the concern that those responsible for regulating the nuclear industry and protecting it from terrorist attack are either in a chronic state of denial or actually believe the propaganda generated by the nuclear industry for public consumption. If this is indeed the case, then one cannot have confidence that emergency planning officials are basing their decisions on accurate and unbiased information. Since the departure of NRC Commissioner Greta Dicus a few years ago, the current Commission does not have any members with backgrounds in radiation protection and health issues. One wonders whether the NRC Commissioners truly understand and appreciate the full extent of the dangers posed by the facilities that they regulate.

(c) The CRAC2 Report Given the lack of credible information from public officials on the potential consequences of a terrorist attack at Indian Point, concerned neighbors of the plant turned to one of the few sources on this subject in the public domain --- the so-called CRAC2 Report, carried out by Sandia National Laboratories (SNL) under contract for NRC in 1981. This study, formally entitled Technical Guidance for Siting Criteria Development, used a computer code developed by SNL known as CRAC2 (Calculation of Reactor Accident Consequences) to analyze the consequences of severe nuclear plant accidents and to study their dependence on population density, meteorological conditions and other characteristics. The version of the CRAC2 Report that had been submitted to NRC for eventual public release only contained average values of consequence results,

13 but the peak values for worst-case weather conditions were obtained by Congressman Edward Markey in 1982 and provided to the Washington Post.13 At many reactor sites, the CRAC2 Report predicted that for unfavorable weather conditions, a severe nuclear reactor accident could cause tens of thousands of early fatalities as a result of severe radiation exposure, and comparable numbers of latent cancer fatalities from smaller exposures. For Indian Point 3 (which at the time operated at a significantly lower power than it now does), CRAC2 predicted peak values of 50,000 early fatalities and 14,000 latent cancer fatalities, with early fatalities occurring as far as 17.5 miles downwind of the site.

The CRAC2 Report only considered accidents affecting operating nuclear reactors, and did not evaluate the consequences of accidents also involving spent fuel storage pools.

Spent fuel pool loss-of-coolant accidents could themselves result in large numbers of latent cancer fatalities, widespread radiological contamination and huge cleanup bills, even if only a fraction of the fuel in the pool were damaged.

The release of the CRAC2 figures caused a great deal of consternation, but NRC was able to defuse the controversy by claiming that the peak results corresponded to accidents with extremely low probabilities (said to be one in a billion), and hence were not a cause for concern. In fact, Robert Bernero, director of the NRCs risk analysis division at the time, said (in a moment of unfortunate prescience) that such severe accidents would be less likely than a jumbo jet crashing into a football stadium during the Superbowl.14 When Riverkeeper and other groups dusted off and called attention to the CRAC2 Report following the September 11 attacks, the NRC appeared unable to appreciate the new relevance of the study in a world where the possibility of a jumbo jet crashing into the Superbowl was no longer so remote. For example, in rejecting a 2001 petition filed by Riverkeeper to shut down the Indian Point plant until Entergy implemented a number of prudent security-related measures, the NRC merely repeated its old probability-based arguments, saying that15 the reactor siting studies in the CRAC2 Report used generic postulated releases of radioactivity from a spectrum of severe (core melt) accidents, independent of the probabilities of the event occurring or the impact of the mitigation mechanisms. The studies were never intended to be realistic assessments of accident consequences. The estimated deaths and injuries resulted from assuming the most adverse condition for each parameter in the analytical code. In the cited studies, the number of resulting deaths and injuries also reflected the assumption that no protective actions were taken for the first 24 13 Subcommittee on Oversight & Investigations, Committee on Interior and Insular Affairs, U.S. House of Representatives, Calculation of Reactor Accident Consequences (CRAC2) For U.S. Nuclear Power Plants Conditional on an SST1 Release, November 1, 1982.

14 Robert J. McCloskey, The Odds of the Worst Case, Washington Post, November 17, 1982.

15 US Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation, Notice of Directors Decision Under 10 CFR 2.206, November 18, 2002.

14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />. The studies did not, and were never intended to, reflect reality or serve as a basis for emergency planning. The CRAC2 Report analyses used more simplistic models than current technologies.

Earlier in 2002, in a letter to the New York City Council, the NRC also said that16 The Sandia study does not factor in the numerous probabilistic risk studies that have been performed since 1982. More realistic, current inputs, assumptions, and modeling techniques would be expected to result in much smaller health consequences.

In a more recent point paper on homeland protection and preparedness, NRC continued to repeat these themes, although its conclusions were somewhat more equivocal: 17 The Sandia Siting Study [CRAC2] was performed to develop technical guidance to support the formulation of new regulations for siting nuclear power reactors. A very large radiation release and delayed evacuation, among other factors, accounts for the more severe consequences As an overall conclusion, that report does not present an up-to-date picture of risk at nuclear plants and does not reflect current knowledge in probabilistic or phenomenological modeling.

Since September 11, 2001, the NRC has been performing assessments of the consequences of a terrorist attack on a nuclear power plant. These assessments are much more detailed than past analyses and reflect our improved understanding of severe accident phenomena. The more recent analyses have involved a more realistic assessment of the radiation release, emergency planning capabilities, radiation spreading, and health effects. More recent analysis indicates a general finding that public health effects from terrorist attacks at most sites are likely to be relatively small.

Although NRC continues to harshly criticize the CRAC2 Report and anyone who cites its results, it has not publicly identified the more realistic, current inputs, assumptions and modeling techniques that would be expected to result in much smaller health consequences, much less demonstrated the validity of these results by providing the public with its calculations for independent review. In fact, NRC now considers that these analyses are too sensitive for public release, making it impossible for the public to verify its claims.

NRCs unwillingness to share this kind of information with the public is not unexpected.

NRC (like its predecessor, the Atomic Energy Commission) has worked over its history to shield the public from estimates of the consequences of severe accidents without simultaneous consideration of the low probabilities of such accidents. By multiplying 16 Hubert Miller, Region I Administrator, US NRC, letter to Donna De Constanzo, Legislative Attorney, New York City Council, July 24, 2002.

17 US Nuclear Regulatory Commission, Point Paper on Current Homeland Protection and Preparedness Issues, November 2003, on the NRC Web site, www.nrc.gov.

15 high consequence values with very low probability numbers, the consequence figures appear less startling to the layman but are obscured in meaning. For instance, a release that could cause 100,000 cancer fatalities would only appear to cause 1 cancer fatality per year if the associated probability of the release were 1/100,000 per year.

This issue was central to the so-called Indian Point Special Proceeding, a 1983 review conducted by a panel of NRC administrative judges that examined whether Indian Point posed unusually high risks because of its location in the densely populated New York metropolitan area. Before this proceeding, the NRC ruled that all testimony on accident consequences must also contain a discussion of accident probabilities. However, in its decision, the three-judge Atomic Safety and Licensing Board panel concluded that the Commission should not ignore the potential consequences of severe-consequence accidents by always multiplying those consequences by low probability values.18 One of the judges dissented from this majority opinion, insisting that singling out Indian Point to the exclusion of many other sites similarly situated in effect raises again the question of considering consequences without their associated probabilities. This we have been restricted from doing by the Commission.19 Today, it appears that this minority opinion ultimately prevailed at NRC.

The results of the CRAC2 Report are indeed of questionable applicability today. But the reasons for this are not the ones that NRC has identified, but include, for example, the fact that the CRAC2 Report

• used census data from 1970, at a time before rampant suburban sprawl greatly increased the population densities in formerly rural areas close to some nuclear reactor sites;

• assumed that the entire 10-mile emergency planning zone would be completely evacuated within at most six hours after issuance of a warning (contrary to NRCs assertion that the CRAC2 peak results reflect the assumption that no protective actions were taken for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), whereas the current evacuation time estimate for the Indian Point EPZ, based on updated assessments of likely road congestion, is nearly ten hours;

• assumed aggressive medical treatment for all victims of acute radiation exposure in developing estimates of the number of early fatalities, and employed a now-obsolete correlation between radiation dose and cancer risk that underestimated the risk by a factor of 4 relative to current models;

• sampled only 100 weather sequences out of 8760 (an entire years worth), a method which we find underestimates the peak value occurring over the course of a year by 30%.

18 US Nuclear Regulatory Commission, Atomic Safety and Licensing Board, Indian Point Special Proceeding, Recommendations to the Commission, October 24, 1983, p. 107.

19 Ibid, Dissenting Views of Judge Gleason, p. 433.

16 In 1990, the CRAC2 code was retired in favor of a new code known as MACCS (MELCOR Accident Consequence Code System), which was updated to MACCS2 in 1997. The MACCS2 code, also developed by Sandia National Laboratories, is the state-of-the-art consequence code employed by both NRC and DOE in conducting dose assessments of radiological releases to the atmosphere. It includes numerous improvements over the CRAC2 code.20 However, the fundamental physics models that form the basis for both the CRAC2 and MACCS2 codes have not changed in the past two decades. Nor has evidence arisen since the CRAC2 Report was issued that would suggest that the CRAC2 source term --- that is, the fraction of the radioactive contents of the reactor core assumed to be released to the environment during a severe accident --- significantly overestimated potential releases.

On the contrary, the Chernobyl disaster in 1986 demonstrated that such large releases were possible.21 The state-of-the art revised source term developed by NRC, as defined in the NRC report NUREG-1465, Accident Source Terms for Light-Water Nuclear Power Plants, is little different from the source terms used in the CRAC2 Report.22 Recent experimental work, including the Phébus tests in France, have provided further confirmation of the NUREG-1465 source term.23 Other tests, such as the VERCORS experiments in France, have found that NUREG-1465 actually underestimates the releases of some significant radionuclides.

The NRC continues to stress the absence of consideration of accident probabilities in dismissing the results of the CRAC2 Report. However, this criticism is invalid in the post-9/11 era. Accident probabilities are not relevant for scenarios that are intentionally caused by sabotage. Severe releases resulting from the simultaneous failure of multiple safety systems, while very unlikely if left up to chance, are precisely the outcomes sought by terrorists seeking to maximize the impact of their attack. Thus the most unlikely accident sequences may well be the most likely sabotage sequences.

20 D.I. Chanin and M.L. Young, Code Manual for MACCS2: Volume 1, Users Guide, SAND97-0594, Sandia National Laboratories, March 1997.

21 The nuclear industry often argues that a Chernobyl-type accident could not happen in the United States because the reactor was of a different and inferior type to US plants and lacked a robust containment structure. While it is true that the specific accident sequence that led to the destruction of the Chernobyl-4 reactor and the resulting radiological release was characteristic of graphite-moderated reactors like Chernobyl and would not likely occur at a US light-water reactor (LWR), it is simply false to claim that there are no possible accident sequences that could result in consequences similar to those of Chernobyl ---

namely, core melt, loss or bypass of containment, and large radiological release to the environment. In fact, because such an event is not as likely to be as energetic as the Chernobyl explosion, and the plume is not likely to be as hot as the Chernobyl plume (which was fed by the burning of a large mass of graphite),

the radiological release from a severe accident at a US LWR will not rise as high or disperse as far.

Therefore, radiological exposure to the public near a US LWR could be far greater than was the case at Chernobyl, because the plume would be more concentrated closer to the plant.

22 L. Soffer, et al., Accident Source Terms for Light-Water Nuclear Power Plants, Final Report, NUREG-1465, US NRC, February 1995.

23 US NRC, Memorandum from Ashok Thadani to Samuel J. Collins, Use of Results from Phébus-FP Tests to Validate Severe Accident Codes and the NRCs Revised Accident Source Term (NUREG-1465),

Research Information Letter RIL-0004, August 21, 2000.

17 Other aspects that add an element of randomness to accident scenarios, such as meteorological conditions, can also be controlled through the advance planning and timing of a terrorist attack. Therefore, even if NRC were correct in claiming that the CRAC2 Report assumes the most adverse condition for each accident-related parameter, such an approach would still be appropriate for analyzing the potential maximum consequences of a sophisticated terrorist attack.

We have not been able to identify any issues that would suggest the consequence estimates provided in the CRAC2 Report were significantly overstated. But in light of the problems with the CRAC2 Report discussed earlier, we have conducted our own analysis of the consequences of a sophisticated terrorist attack at the Indian Point plant, using the MACCS2 code and the most up-to-date information available. This included the NUREG-1465 revised source term, the most current dose conversion and cancer risk coefficients recommended by the International Commission on Radiological Protection (ICRP), and the most recent evacuation time estimate (ETE) for Indian Point developed by consultants for Entergy Nuclear, the plant operator. We used the SECPOP2000 code, developed for NRC by Sandia National Laboratories, to generate a high-resolution MACCS2 site data file that includes a regional population distribution based on 2000 Census data and an economic data distribution based on 1997 government statistics.

For Indian Point, we find that the MACCS2 results for peak early fatalities are generally consistent with the CRAC2 Report, but that the CRAC2 Report significantly underestimates the peak number of latent cancer fatalities that could occur.

Moreover, the consequence estimates in this report are based on a number of optimistic assumptions, or conservatisms, that tend to underestimate the true consequences of a terrorist attack at Indian Point. For example:

1. We use an evacuation time estimate that assumes the attack takes place in the summer in good weather, and does not take into account the possibility that terrorists may time their attack when evacuation is more difficult or actively interfere with the evacuation.

2. We only consider the permanent resident population of the 10-mile plume exposure EPZ, and not the daily transient population, which would increase the total population of the EPZ by about 25%.

3. We use values for the rated power of the Indian Point reactors from 2002 that are about 5% lower than the current values.

4. The only health consequences we consider are early fatalities from acute radiation syndrome and latent fatalities from cancer. We do not assess the excess mortality associated with the occurrence of other well-documented health effects of radiation such as cardiovascular disease. We also do not consider non-fatal effects of radiation, such as the reduction in intelligence quotient (IQ) of children irradiated in utero or other birth defects.

18

5. The NUREG-1465 source term does not represent the maximum possible radiological release from a core melt. Also, the assumed delay time between the attack and the start of the radiological release is nearly two hours, which is not nearly as short as the minimum of 30 minutes that is contemplated in NRCs emergency planning regulations.

6. The calculations assume only that the reactors itself are attacked and that the large quantity of spent fuel in the wet storage pools remains undamaged.

In the following sections, we discuss some technical issues related to severe accident and sabotage phenomena. Then we describe the methodology, tools and input parameters used to carry out the calculation. Finally, we present our results and conclusions.

19 ACCIDENTS: DESIGN-BASIS, BEYOND-DESIGN-BASIS, AND DELIBERATE The NRC has traditionally grouped nuclear reactor accidents into two main categories:

design-basis accidents, and beyond-design-basis or severe accidents.

(a) Design-basis accidents Design-basis accidents are accidents that nuclear plants must be able to withstand without experiencing unacceptable damage or resulting in radiological releases that exceed the regulatory limits known as Part 100 releases (because of where they can be found in the NRC regulations).

One of the more challenging design-basis accidents for pressurized-water reactors (PWRs) like those at Indian Point is a loss-of-coolant accident (LOCA). In the primary system of a PWR, the reactor core, which is contained in a steel vessel, is directly cooled by the flow of high-pressure water forced through pipes. In a LOCA, a pipe break or other breach of the primary system results in a loss of the water essential for removing heat from the reactor fuel elements. Even if the nuclear reactor is immediately shut down or scrammed, an enormous quantity of heat is still present in the fuel, and cooling water must be restored before a significant number of fuel elements reach temperatures above a critical limit. If heated beyond this limit, the fuel element cladding can become brittle and shatter upon contact with cooling water. Eventually, the core geometry can become uncoolable and the fuel pellets themselves will reach temperatures at which they start to melt.

In a design-basis LOCA, it is assumed that the emergency core cooling system (ECCS) works as designed to provide makeup coolant water to the nuclear fuel, terminating the event before it becomes impossible to control. Even in this case, however, a significant fraction of the radioactive inventory in the core could be released into the coolant and transported out of the primary system through the pipe break. The primary system therefore must be enclosed in a leak-tight containment building to ensure that Part 100 limits are not exceeded in the event of a design-basis LOCA. To demonstrate compliance with Part 100, dose calculations at the site boundary are carried out by specifying a so-called source term --- the radioactive contents of the gases within the containment following the LOCA --- and assuming that the containment building leaks at its maximum design leak rate, typically about 0.1% per day. Such an event was historically considered a maximum credible accident.

(b) Beyond-design-basis accidents In contrast to design-basis accidents, beyond-design-basis accidents (also known as severe accidents) are those in which multiple failures occur, backup safety systems do not work as designed, the core experiences a total meltdown and radiological releases far greater than the Part 100 limits become possible. For example, if the ECCS does not work properly after a LOCA, the core will continue to overheat, eventually forming a

20 molten mass that will breach the bottom of the steel reactor vessel and drop onto the containment floor. It will then react violently with any water that is present and with concrete and other materials in the containment. At this point, there is little hope that the event can be terminated before much of the radioactive material within the fuel is released in the form of gases and aerosols into the containment building.

Even worse is the potential for mechanisms such as steam or hydrogen explosions to rupture the containment building, releasing its radioactive contents into the environment.

Although not the only distinguishing feature, a major distinction between design-basis and severe accidents is whether containment integrity is maintained. Even a small rupture in the containment building --- no more than a foot in diameter --- would be sufficient to depressurize it and to vent the gases and aerosols it contains into the environment in less than half an hour.24 This would result in a catastrophic release of radioactivity on the scale of Chernobyl, and Part 100 radiation exposure limits would be greatly exceeded.

The containment building can also be bypassed if there is a rupture in one of the interfaces between the primary coolant system and other systems that are outside of containment, such as the secondary coolant system (the fluid that drives the turbine generators) or the low-pressure safety injection system. For instance, the rupture in the steam generator that occurred at Indian Point 2 in February 2000 created a pathway in which radioactive steam from the primary system was able to pass into the secondary system, which is not enclosed in a leak-tight boundary. If that event had coincided with significant fuel damage, the radiological release to the environment could have been far greater.

NRC has always had an uncomfortable relationship with beyond-design-basis accidents.

By their very definition, they are accidents that were not considered in the original design basis for the plant. In fact, according to NRC, the technical basis for containment design was intended to ensure very low leakage under postulated loss-of-coolant accidents. No explicit consideration was given to performance under severe accidents.25 Indeed, NRC has never instituted a formal regulatory requirement that severe accidents be prevented. In 1985, the Commission ruled by fiat in its Severe Accident Policy Statement that existing plants pose no undue risk to health and safety and that no regulatory changes were required to reduce severe accident risk. NRCs basic assumption is that if a plant meets design basis requirements, then it will have sufficient resistance against severe accidents, and it has devoted considerable resources to the task of confirmatory research to justify this assumption. NRC believes that this approach provides adequate protection of public health and safety because the probability of a 24 US Nuclear Regulatory Commission, Preliminary Assessment of Core Melt Accidents at the Zion and Indian Point Nuclear Power Plants and Strategies for Mitigating Their Effects, Analysis of Containment Building Failure Modes, Preliminary Report, NUREG-0850, Vol. 1, November 1981, p. 3-2.

25 US Nuclear Regulatory Commission, Reactor Risk Reference Document (Appendices J-0), NUREG-1150, Draft for Comment, February 1987, p. J.10-1.

21 severe accident capable of rupturing or bypassing the containment prior to effective evacuation of the EPZ is so low in most cases as to be below regulatory concern.26 (c) Deliberate accidents It is true that a spontaneous occurrence of the multiple system failures necessary to cause a severe accident and large radiological release is typically a very improbable event.

However, if one considers the possibility of sabotage or deliberate accidents, the low-probability argument that NRC uses to justify the continued operation of nuclear plants completely breaks down. Terrorists with basic and readily available knowledge of how nuclear plants operate can design their attack to maximize the chance of achieving a core melt and large radiological release. With modest inside assistance, as contemplated by NRC in its regulations and practices, saboteurs would be able to identify a plant-specific set of components known as a target set. If all elements of a target set are disabled or destroyed, significant core damage would result. Thus, by deliberately disrupting all redundant safety systems, saboteurs can cause a severe event that would have had only a very low probability of occurrence if left to chance.

The likelihood of a successful attack is enhanced for plants with common-cause failure modes. A common-cause failure is a single event that can lead to the failure of multiple redundant systems. For example, if the diesel fuel supplied to a nuclear plant with two independent emergency diesel generators from the same distributor is impure, then both generators may fail to start for the same reason if off-site power is lost and emergency power is needed. This would result in a station blackout, one of the most serious challenges to pressurized-water reactors like Indian Point. While some common-cause failure modes can be corrected, others are intrinsic to the design of currently operating nuclear plants. Common-cause failure modes make the saboteurs job easier, as fewer targets would have to be disabled to achieve the desired goal.

In addition to causing a core meltdown, terrorists also have the means to ensure that the radioactive materials released from the melting fuel can escape into the environment by breaching, severely weakening or bypassing the containment.27 Finally, saboteurs can maximize the harm caused by a radiological release by staging their attack when the meteorological conditions favor a significant dispersal over densely populated areas, and even interfering with the execution of emergency plans.

NRC has formally maintained for at least two decades that it does not make sense to assign probabilities to terrorist attacks. In a 2002 memorandum, NRC stated that28 the horrors of September 11 notwithstanding, it remains true that the likelihood of a terrorist attack being directed at a particular nuclear facility is not 26 There have been situations where NRC concluded that adequate protection was not met at certain nuclear plants and required additional safety measures. However, such instances are rare.

27 We have decided not to describe such means in greater detail, although we have little doubt that terrorists are already familiar with them.

28 US NRC, Memorandum and Order, CLI-02-025, December 18, 2002, p. 17.

22 quantifiable. Any attempt at quantification or even qualitative assessment would be highly speculative. In fact, the likelihood of attack cannot be ascertained with confidence by any state-of-the-art methodology we have no way to calculate the probability portion of the [risk] equation, except in such general terms as to be nearly meaningless.

Yet at other times, NRC does not hesitate to invoke probabilities when arguing that the public has nothing to fear from terrorist attacks on nuclear plants. For example, here is what NRC has to say about the CRAC2 study in its recent point paper on homeland protection and preparedness:29 Over the years, the NRC has performed a number of consequence evaluations to address regulatory issues We have considered the extent to which past analyses, often the subject of public statements by advocacy groups and the media, can be superceded [sic] by more recent analysis Past studies usually have considered a number of scenarios, which resulted in only minor consequences. The most limiting severe scenarios, which comprise a minority of the calculations and represent very low probability events [emphasis added], are the predictions typically cited in press accounts. These scenarios have assumed very large radiation releases, bounding emergency response assumptions or bounding conditions (including weather) for the spread of the radiation. The combination of these factors produces large and highly unlikely results.

These two excerpts are inconsistent. If it is meaningless to quantify the likelihood of a terrorist attack, then one cannot dismiss the possibility of terrorist attacks causing the most severe consequences by claiming they are highly unlikely. Therefore, in order to base emergency planning on the best possible information, NRC must accept the fact that the growing threat of domestic terrorism has forever altered the delicate risk calculus that underlies its approach to safety regulation. NRC can no longer shy away from confronting the worst-case consequences of terrorist attacks on nuclear power plants.

And perhaps the most attractive target in the country, where the consequences are likely to be the greatest, is Indian Point.

29 US NRC, Point Paper on Current Homeland Protection and Preparedness Issues (2003), op cit.

23 THE HEALTH CONSEQUENCES OF A RADIOLOGICAL RELEASE FROM INDIAN POINT The Indian Point power plant is located on 239 acres on the Hudson River in the village of Buchanan in Westchester County, New York. There are two operating pressurized-water reactors (PWRs) on site, Indian Point 2, rated at 971 MWe, and Indian Point 3, rated at 984 MWe. Both reactors are operated by Entergy Nuclear.

Indian Point is located in one of the most densely populated metropolitan areas in the United States, situated about 24 miles from the New York City limits and 35 miles from midtown Manhattan. Extrapolating from 2000 Census data, in 2003 over 305,000 persons resided within the roughly ten-mile radius plume exposure emergency planning zone for Indian Point, and over 17 million lived within 50 miles of the site.30 The types of injury that may occur following a catastrophic release of radioactive material resulting from a terrorist attack at Indian Point fall into two broad categories.

The first category, early injuries and fatalities, are those that are caused by short-term whole-body exposures to doses of radiation high enough to cause cell death. Early injuries include the constellation of symptoms known as acute radiation syndrome that should be familiar to anyone who has read Hiroshima by John Hersey --- gastrointestinal disturbance, epilation (hair loss) and bone marrow damage. Other early injuries include severe skin damage, cataracts and sterility. For sufficiently high doses, early fatalities ---

death within days or weeks --- can occur. These so-called deterministic effects are induced only when levels of radiation exposure exceed certain thresholds.

Another class of injury caused by ionizing radiation exposure is genetic damage that is insufficient to cause cell death. At doses below the thresholds for deterministic effects, radiation may cause damage to DNA that interferes with the normal process of cell reproduction. This damage can eventually lead to cancer, which may not appear for years or even decades, depending on the type. Because a single radiation-induced DNA lesion is believed to be capable of progressing to cancer, there is no threshold for these so-called stochastic effects.31 The clinical response of individuals to ionizing radiation exposure is highly variable from person to person. Some individuals have a lower capability of DNA repair and thus are more susceptible to the carcinogenic effects of radiation --- a condition that is most severe in people with certain genetic diseases like ataxia telangiectasia. Children are particularly vulnerable to radiation exposure. For the same degree of exposure to a 30 A figure of 20 million people within 50 miles of Indian Point has often been quoted. This value may have been obtained by summing the populations of all counties that are either totally or partially within the 50-mile zone.

31 A small but vocal group of pro-nuclear activists continue to maintain, in the face of overwhelming scientific evidence to the contrary, that a threshold dose exists below which ionizing radiation may have no effect or even may provide health benefits. However, there is a growing body of experimental data that indicates that low-dose radiation may actually be a more potent carcinogen than high-dose radiation because of low-dose bystander effects.

24 radioactive plume, children will receive a greater absorbed dose than adults because of their lower body weight and higher respiration rate, even though their lung capacity is smaller. And because children and fetuses have much higher growth rates than adults, the same radiation dose has a greater chance of causing cancer in children and fetuses than in adults.

Exposure to low-dose ionizing radiation has also been associated with excess mortality from diseases other than cancer, such as cardiovascular disease, possibly as a result of radiation-induced inflammation. There is growing evidence that the effect of low-dose radiation exposure on mortality from diseases other than cancer may be as great as its effect on mortality from cancer, implying that current, cancer-based risk estimates may be too low by a factor of two.32 A radiological release from a nuclear plant accident would consist of many different types of radioactive materials. Some isotopes, such as cesium-137, emit penetrating gamma rays and can cause radiation injury from outside of the body. Other isotopes do not emit radiation that can penetrate skin but are most dangerous when inhaled or ingested, where they can concentrate in internal organs and deliver high doses to surrounding tissue. Iodine-131, which concentrates in the thyroid gland, and strontium-90, which concentrates in teeth and bones, are in this category. Some isotopes have short half-lives and do not persist in the environment, while others are long-lived and can result in long-term contamination.

NRC requires that evacuation planning in the event of a radiological emergency take place only within the so-called plume exposure emergency planning zone (EPZ), a roughly circular area with a radius of approximately ten miles. The choice of this distance was based in part on NRC analyses indicating that in the event of a severe accident, dose rates high enough to cause early fatalities from acute radiation syndrome would be confined to a region within about ten miles of the release point. However, dose rates outside of this region, although on average not high enough to cause early fatalities, could be high enough to result in a significant risk of cancer unless effective protective measures are taken. NRCs emergency planning regulations were never designed to limit such exposures in the event of the worst core melt sequences, for which the protection goal is that immediate life threatening doses would generally not occur outside the zone.33 Thus the current emergency planning basis is not now, and never was, intended to protect the public from significant but not immediately lethal exposures in the event of the worst core melt sequences, such as those that could result from a well-planned terrorist attack. It should therefore be no surprise that NRCs emergency planning procedures 32 A. MacLachlan, UNSCEAR Probes Low-Dose Radiation Link to Non-Cancer Death Rate, Nucleonics Week, June 17, 2004.

33 US NRC, Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Plants, NUREG-0654, 1980, p. 12.

25 would not protect individuals either inside or outside the EPZ from such exposures in the event of an attack.

The proximity of Indian Point to New York City, its populous suburbs and its watershed, given the potential hazard it represents, has long been an issue of concern and controversy. Following the Three Mile Island accident in March 1979, the Union of Concerned Scientists (UCS) unsuccessfully petitioned the NRC to suspend operations at Indian Point, in part because of its location in a densely populated area. At the same time, the NRC formed two task forces to examine the risks posed by Indian Point and the Zion plant near Chicago because of the high population densities surrounding those units and initiated a formal adjudication, the Indian Point Special Proceeding, to review the issues raised in the UCS petition and others.34 During the Special Proceeding, three NRC administrative judges heard testimony regarding the potential impacts of a severe accident at Indian Point on New York City residents. For instance, the director of New York Citys Bureau of Radiation Control testified that potassium iodide (KI), which can block the uptake of radioactive iodine by the thyroid if taken near the time of exposure, should be stockpiled for possible immediate use in New York City, at a time when NRC did not recommend that KI be provided even for residents of the 10-mile EPZ.

The administrative judges reached some disturbing conclusions in the proceeding. They stated that under certain meteorological conditions, delayed fatalities from cancer appear to be possible almost anywhere in the city and that a severe release at Indian Point could have more serious consequences than that same release at virtually any other site licensed by the Commission. And they urged the Commission to give serious consideration to the potential costs to society of dangerous, low probability accidents.

Such accidents could, as Staff testimony has shown, result in fatalities that number in the hundreds or thousands.

The Commission appears to have essentially forgotten these conclusions. Many of the technical issues resolved during the course of the Special Proceeding are being debated all over again today.

34 US NRC, Indian Point Special Proceeding, 1983, p. 5.

26 THE MACCS2 CODE MACCS2 is a computer code that was developed by Sandia National Laboratories under NRC sponsorship as a successor to CRAC2.35 It is designed to estimate the health, environmental and economic consequences of radiation dispersal accidents, and is widely used by NRC and DOE for various safety applications. It utilizes a standard straight-line Gaussian plume model to estimate the atmospheric dispersion of a point release of radionuclides, consisting of up to four distinct plumes, and well-established models to predict the deposition of radioactive particles on the ground from both gravitational settling (dry deposition) and precipitation (wet deposition).36 From the dispersion and deposition patterns, the code can then estimate the radiation doses to individuals as a result of external and inhalation exposures to the radioactive plume and to external radiation from radionuclides deposited on the ground (groundshine). The code also has the capability to model long-term exposures resulting from groundshine, food contamination, water contamination and inhalation of resuspended radioactive dust.

The code also can evaluate the impact of various protective actions on the health and environmental consequences of the release, including evacuation, sheltering and, in the long term, remediation or condemnation of contaminated areas. Most parameters, such as the average evacuation speed, decontamination costs, and the dose criteria for temporary relocation and long-term habitation, can be specified by the user.

MACCS2 requires a large number of user-specified input parameters. A given release is characterized by a source term, which is defined by its radionuclide content, duration and heat content, among other factors. The shape of the Gaussian plume is determined by the wind speed, the release duration, the atmospheric stability (Pasquill) class and the height of the mixing layer at the time of the release.

MACCS2 requires the user to supply population and meteorological data, which can range from a uniform population density to a site-specific population distribution on a high-resolution polar grid. The meteorological data can range from constant weather conditions to a 120-hour weather sequence. The code can process up to 8760 weather sequences --- a years worth --- and generate a frequency distribution of the results.

The code allows the user to define the dose-response models for early fatalities (EFs) and latent cancer fatalities (LCFs). We use the MACCS2 default models. For EFs, MACCS2 uses a 2-parameter hazard function, with a default LD50 dose (the dose associated with a 50% chance of death) of 380 rem. LCFs, MACCS2 uses the standard linear, no-threshold model, with a dose-response coefficient of 0.1 LCF/person-Sievert and a dose-dependent reduction factor of 2, per the 1991 recommendations of the International Committee on 35 Chanin and Young (1997), op cit.

36 Much of the following section is based on a recent comprehensive review of MACCS2 by the Department of Energy, which we would recommend to readers interested in a more in-depth discussion of the capabilities and limitations of the code. See Office of Environment, Safety and Health, U.S.

Department of Energy, MACCS2 Computer Code Application Guidance for Documented Safety Analysis:

Interim Report, DOE-EH-4.2.1.4-Interim-MACCS2, September 2003.

27 Radiological Protection (ICRP) in ICRP 60.37 The corresponding coefficients used in the CRAC2 model, based on now-antiquated estimates, were lower by a factor of 4.

For the calculation of the committed effective dose equivalent (CEDE) resulting from inhalation and ingestion of radionuclides, we have replaced the default MACCS2 input file with one based on the more recent dose conversion factors in ICRP 72.38 We have shown previously that this substitution reduces the projected number of latent cancer fatalities from a severe nuclear reactor accident by about one-third.39 (The default MACCS2 file incorporates EPA guidance based on ICRP 30, which although out of date continues to be the basis for regulatory analyses in the United States.)

When using MACCS2 several years ago, we discovered an error that resulted in an overcounting of latent cancer fatalities in the case of very large releases. After pointing this out to the code manager, SNL sent us a revised version of the code with the error corrected, which we have used for the analysis in this report.

Like most radiological consequence codes in common use, MACCS2 has a number of limitations. First of all, because it incorporates a Gaussian plume model, the speed and direction of the plume are determined by the initial wind speed and direction at the time of release, and cannot change in response to changing atmospheric conditions (either in time or in space). Consequently, the code becomes less reliable when predicting dispersion patterns over long distances and long time periods, given the increasing likelihood of wind shifts. Also, the Gaussian plume model does not take into account terrain effects, which can have a highly complex impact on wind field patterns and plume dispersion. And finally, MACCS2 cannot be used for estimating dispersion less than 100 meters from the source.

However, MACCS2 is adequate for the purpose of this report, which is to develop order-of-magnitude estimates of the radiological consequences of a catastrophic attack at Indian Point for residents of New York City and the entire New York metropolitan area, and to assess the impact of different protective actions on these consequences. We restrict our evaluations to a circular area with a radius of 50 miles centered on Indian Point, except for the calculation of long-term doses and economic impacts, which we assess out to 100 miles.

In the next section, we discuss the basis for the MACCS2 input parameters that we use in our evaluation.

37 MACCS2 does not allow the user to specify different dose-response models for different radionuclides.

We use a model with a dose-dependent reduction factor of 2, even though this assumption likely underestimates the carcinogenic potential of alpha-emitters, which is not reduced in effectiveness at low doses or dose rates.

38 International Commission on Radiological Protection (ICRP), Age-Dependent Doses to Members of the Public from Intake of Radionuclides: Part 5, Compilation of Ingestion and Inhalation Dose Coefficients, ICRP Publication 72, Pergamon Press, Oxford, 1996.

39 E. Lyman, Public Health Risks of Substituting Mixed-Oxide for Uranium Fuel in Pressurized-Water Reactors, Science and Global Security 9 (2001), pgs. 33-79. See Footnote 48.

28 THE SABOTAGE SCENARIO The scenario that we analyze is based on the so-called revised source term that NRC defined in 1995 in NUREG-1465. The revised source term was developed as a more realistic characterization of the magnitude and timing of radionuclide releases during a core-melt accident than the source term originally specified for use in Part 100 siting analyses. In its entirety, the PWR revised source term presented in NUREG-1465 corresponds to a severe accident in which the primary coolant system is depressurized early in the accident sequence. An example is a large break loss-of-coolant accident (LBLOCA), in which primary coolant is rapidly lost and the low-pressure safety injection system fails to operate properly, resulting in core melt and vessel failure. This scenario is one of the most severe events that can occur at PWRs like Indian Point, and could result in a relatively rapid release of radioactivity.

(a) The source term A severe accident of this type would progress through four distinct phases. As the water level in the core decreases and the fuel becomes uncovered, the zirconium cladding tubes encasing the fuel rods overheat, swell, oxidize and rupture. When that occurs, radionuclides that have accumulated in the gap between the fuel and the cladding will be released into the reactor coolant system. If there is a break in the reactor coolant system (as would be the case in a LBLOCA), then these radionuclides would be released into the atmosphere of the containment building. These so-called gap releases consist of the more volatile radionuclides contained in irradiated fuel, such as isotopes of krypton, xenon, iodine and cesium. This period is known as the gap release phase, and is predicted to last about 30 minutes. The oxidation of the zirconium cladding by water also generates hydrogen, which is a flammable gas.

As the core continues to heat up, the ceramic fuel pellets themselves begin to melt, releasing greater quantities of radionuclides into the reactor vessel and through the breach in the reactor coolant system into the containment building atmosphere. The molten fuel mass then collapses and drops to the bottom of the reactor vessel, where it aggressively attacks the steel, melts through the bottom and spills onto the floor of the containment building. 40 The period between the start of fuel melting and breach of the reactor vessel is known as the early in-vessel phase, and typically would last about an hour.

When the molten fuel breaches the reactor vessel and drops to the containment building floor, it violently reacts with any water that has accumulated in the cavity and with the concrete floor itself. This core-concrete interaction causes further releases of radionuclides from the molten fuel into the containment building. This period is known as the ex-vessel phase, and would last for several hours.

40 This scenario is not theoretical. During the 1979 accident at Three Mile Island Unit 2, part of the melted core relocated to the bottom of the reactor vessel where it began melting through the steel. The re-introduction of forced cooling water flow terminated this sequence before vessel failure.

29 At the same time, some portion of the molten core may remain in the reactor vessel, where it would continue to degrade in the presence of air and release radionuclides. Also, radionuclides released during the in-vessel phase that deposit on structures within the primary coolant system may be re-released into the containment building. These releases take place during the late in-vessel phase and could continue for many hours.

At the time when the molten core falls to the floor of the reactor vessel, steam explosions may occur that could blow apart the reactor vessel, creating high-velocity missiles that could rupture the containment building and violently expel the radioactive gases and aerosols it contains into the environment. This would result in a shorter in-vessel phase.

If the vessel remains intact until melt-through, hydrogen or steam explosions are also possible when the molten fuel spills onto the concrete below the vessel, providing another opportunity for containment failure.

The complete revised source term (all four phases) is a general characterization of a low-pressure severe accident sequence, such as a large-break loss of coolant accident with failure of emergency core cooling systems. According to the timing of the accident phases in the revised source term, the gap release phase would begin within a few minutes after the initiation of the event and lasts for 30 minutes. At that time, the early in-vessel phase begins as the fuel pellets start to melt. This phase is assumed to last for 1.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, and ends when the vessel is breached.

In our scenario, we assume that the attackers have weakened but not fully breached the containment, so that there is a high probability that the containment building will be ruptured by a steam or hydrogen explosion at the time of vessel breach. This results in a rapid purge of the radionuclide content of the containment building atmosphere into the environment, followed by a longer-duration release due to core-concrete interactions and late in-vessel releases.

We do not wish to discuss in detail how saboteurs could initiate this type of accident sequence. However, since NRC asserts that even in a terrorist attack these events are unlikely to occur, we need to present some evidence of the plausibility of these scenarios.

One such scenario would involve a 9/11-type jet aircraft attack on the containment building, possibly accompanied by a ground attack on the on-site emergency power supplies. (One must also assume that interruption of off-site power takes place during an attack, given that off-site power lines are not under the control of the licensee and are not protected.)

The Nuclear Energy Institute (NEI) issued a press release in 2002 describing some of the conclusions of a study conducted by the Electric Power Research Institute (EPRI) that purported to show that penetration of a PWR containment by a jet aircraft attack was impossible. A study participant later acknowledged that (1) the justification for limiting the impact speed to 350 mph was based on pilot interviews and not on the results of simulator testing, and (2) even at 350 mph, their analysis actually found that the 42-inch

30 thick reinforced concrete containment dome of a PWR suffered substantial damage and the steel liner was deformed.41 However, even if penetration of the containment does not occur, the vibrations induced by the impact could well disrupt the supports of the coolant pumps or the steam generators, causing a LBLOCA. The emergency core cooling system pumps, which require electrical power, would not be available under blackout conditions caused by the disabling of both off-site and on-site power supplies. Thus makeup coolant would not be provided, the core would rapidly become uncovered and the NUREG-1465 sequence would begin. Other engineered safety features such as containment sprays and recirculation cooling would not be available in the absence of electrical power. The damaged containment building would then be far less resistant to the pressure pulse caused by a steam spike or hydrogen explosion, and would have a much higher probability of rupture at vessel breach. We note that the steel liner of a reinforced concrete containment structure like that at Indian Point only carries 10 to 20% of the internal pressure load, and therefore may fail well before the design containment failure pressure is reached if the concrete shell is damaged.

Because the emergency diesel generators are themselves quite sensitive to vibration, a ground assault may not even be necessary to disable them, since the aircraft impact itself, followed by a fuel-air explosion, could cause them to fail.

One can find support for the credibility of this scenario in the recently leaked summary of a report prepared for the German Environment Ministry by the nuclear safety consultant GRS on the vulnerability of German nuclear reactors to aircraft attacks.42 In the summary, GRS defined a series of credible damage scenarios and then determined whether or not the resulting accident sequence would be controllable The report considered an attack on the Biblis B PWR by a small jet (Airbus A320) or medium-sized jet (Airbus A300) travelling at speeds from 225 to 394 miles per hour, where the peak speed of 394 mph was determined through the use of simulators. GRS concluded that for an event in which the jet did not penetrate the containment, but the resulting vibrations caused a primary coolant leak, and the control room was destroyed by debris and fire (a condition similar to a station blackout), then control of the sequence of events would be uncertain.43 Biblis B was designed for protection against the crash of a 1960s-era Starfighter jet and as a result is equipped, like most German reactors, with a double containment. In contrast, Indian Point 2 and 3, while of the same 1970s vintage as Biblis B, were not designed to be resistant to airplane crashes, and do not have double containments.

41 R. Nickell, Nuclear Plant Structures: Resistance to Aircraft Impact, 44th Annual Meeting of the Institute of Nuclear Materials Management, Phoenix, AZ, July 13-17, 2003.

42 Mark Hibbs, Utilities Expect Showdown with Trittin over Air Terror Threat, Nucleonics Week 45, February 12, 2004.

43 Gesellschaft für Anlagen und Reaktorsicherheit, Schutz der deutschen Kernkraftwerke vor dem Hintergrund der terroristischen Anschlge in den USA vom 11. September 2001, (Protection of German Nuclear Power Plants in the Context of the September 11, 2001 Terrorist Attacks in the US), November 27, 2002.

31 The NUREG-1465 revised source term is shown in Table 1. The source term is characterized by grouping together fission products with similar chemical properties and for each group specifying a release fraction; that is, the fraction of the core radionuclide inventory released from the damaged fuel into the containment building atmosphere. Noble gases include krypton (Kr); halogens include iodine (I); alkali metals include cesium (Cs); noble metals include ruthenium (Ru); the cerium (Ce) group includes actinides such as plutonium (Pu) and the lanthanide (La) group includes actinides such as curium (Cm).

TABLE 1: NUREG-1465 radionuclide releases into containment for PWRs Gap Early In-Vessel Ex-Vessel Late In-Vessel Duration (hrs) 0.5 1.3 2.0 10.0 Release fractions (%):

Noble Gases (Kr) 0.05 0.95 0

0 Halogens (I) 0.05 0.35 0.25 0.1 Alkali Metals (Cs) 0.05 0.25 0.35 0.1 Tellurium group (Te) 0 0.05 0.25 0.005 Barium, Strontium (Ba, Sr) 0 0.02 0.1 0

Noble Metals (Ru) 0 0.0025 0.0025 0

Cerium group (Ce) 0 0.0005 0.005 0

Lanthanides (La) 0 0.0002 0.005 0

It is important to note that NUREG-1465 is not intended to be a worst-case source term.

The accompanying guidance specifically states that it is emphasized that the release fractions for the source terms presented in this report are intended to be representative or typical, rather than conservative or bounding values44 In fact, the release fractions for tellurium, the cerium group and the lanthanides were significantly lowered in response to industry comments. Upper-bound estimates, which are provided in a table in the back of NUREG-1465, indicate that virtually all the iodine and cesium could enter the containment.45 And experimental evidence obtained since NUREG-1465 was published in 1995 suggests that the tellurium, ruthenium, cerium and lanthanide release fractions in the revised source term may significantly underestimate actual releases of these radionuclide groups.46 Thus our use of the NUREG-1465 source term is far from the worst possible case and may underestimate the impacts of credible scenarios.

44 NUREG-1465, p. 13.

45 NUREG-1465, p. 17.

46 Energy Research, Inc., Expert Panel Report on Source Terms for High-Burnup and MOX Fuels, 2002.

32 We model this scenario in MACCS2 as a two-plume release. The first release begins at the time of vessel breach and containment failure, 1.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after initiation of the accident, and continues over a period of 200 seconds as the containment atmosphere is rapidly vented. The second plume lasts for two hours as core-concrete interactions occur. For simplicity, only the first two hours of the late in-vessel release are included; the last eight hours are omitted, although this late release would likely make a significant contribution to public exposures, given the nearly ten-hour evacuation time estimate for the 10-mile EPZ.

We further assume that the entire radionuclide inventory released from the damaged fuel into the containment atmosphere escapes into the environment through the rupture in the containment. There is little information in the literature about realistic values for the fraction of the containment inventory that is released to the environment. In NUREG-1150, NRC states that in some early failure cases, the [containment to environment]

transmission fraction is quite high for the entire range of uncertainty. In an early containment failure case for the Sequoyah plant the fractional release of radioactive material ranges from 25 percent to 90 percent of the material released from the reactor coolant system.47 A review of the default values of this fraction for the Sequoyah and Surry plants used in supporting analyses for NUREG-1150 indicates that environmental releases ranging from 80 to 98% of the radionuclides in the containment atmosphere were typically assumed. The only case in which significant retention within the containment building occurs is when there is a delay of several hours between the initiation of core degradation and the time of containment failure, which is not the case for the scenario we are considering. Given that we are using only the first three phases of the NUREG-1465 source term, which may underestimate the maximum release of radionuclides like iodine and cesium by 35%, we believe it is reasonable to neglect the retention within the containment building of at most 20% of the radionuclide inventory.

Another plume characteristic that is very important for determining the distribution and magnitude of consequences is the heat energy that it contains. The oxidation of zirconium cladding during core degradation generates a large amount of heat in a short period of time, which can cause the plume to become buoyant and rise. Greater initial plume heights result in lower radionuclide concentrations close to the plant, but wider dispersal of the plume.

It is unlikely that a radiological release at any US PWR would produce a plume as high as the one released during the Chernobyl disaster. Because of the large mass of graphite moderator in the Chernobyl-4 reactor, a hot and long-duration graphite fire caused a very high plume that was responsible for dispersing radionuclides over vast distances.

However, at the same time, the exposure and contamination within 50 miles of the Chernobyl site was much lower than it would have been if the plume had not risen so high. This means that the cooler plume that would be characteristic of a core meltdown at Indian Point could actually be a greater threat to the New York metropolitan area than the contamination pattern resulting from the Chernobyl accident might suggest.

47 US NRC, Severe Accident Risks: An Assessment for Five Nuclear Power Plants, NUREG-1150, Volume 2, December 1990, p. C-108.

33 Table 2 shows the two-plume source term for input into MACCS2, adapted from the NUREG-1465 source term in Table 1. The first plume consists of the containment radionuclide inventory at the time of vessel breach (the sum of the first and second columns in Table 1). The second plume consists of the releases generated by core-concrete interactions and a fraction of the late-in-vessel releases (the sum of the third column and one-fifth of the fourth column in Table 1).

TABLE 2: Source term used in MACCS2 model Plume Release time (hrs)

Duration(hrs) Energy release (MW)

Kr I Cs Te Ba Ru Ce La 1

1.8 0.06 2.8 1

0.4 0.3 0.05 0.02 0.0025 0.0005 0.0002 2

1.86 2

1.6 0

0.27 0.37 0.25 0.1 0.0025 0.005 0.005 The reactor core inventory used was calculated for a representative 3565 MWt PWR at the end of an equilibrium 18-month cycle using the SCALE code, and was then scaled to the Indian Point 2 power rating of 3071 MWt.48 Since Indian Point 2 operates on a 24-month cycle, the inventory we use here does not represent the peak inventory of the reactor core, which occurs just before refueling.

(b) Meteorology The calculation of radiological consequences from a severe accident is strongly dependent on the meteorological conditions at the time of the release and for several days afterward. Relevant factors include the wind speed, the wind direction, the atmospheric stability, the height of the mixing layer and the occurrence of precipitation.

The MACCS2 code can utilize a weather sequence of hourly data for a 120-hour period following the initial release. The user has the option to supply a file with an entire years worth of hourly meteorological data (8760 entries), consisting of wind speed, atmospheric stability class, and precipitation. The program can then calculate up to 8760 results, each corresponding to a release beginning at a different hour of the year. For each set of weather data, MACCS2 can also generate sixteen results by rotating the plume direction into each sector of the compass, repeating the calculation for each plume direction, and then weighting the results with the fraction of the time that the wind blows in that direction (as specified by the user-supplied wind rose, or set of probabilities that the wind will be blowing in a certain direction at the site). Finally, the code can tabulate the results in a frequency distribution.

48 Lyman (2001), op cit., pp. 64-66.

34 The MACCS2 code, like the CRAC2 code before it, has the option to sample a reduced number of weather sequences, based on a semi-random sampling method. The reason for employing a sampling scheme in the past was no doubt the length of computing time needed for each calculation; however, the program runs quickly on modern machines, so there is no need to employ the MACCS2 sampling scheme. In fact, a comparison of the results obtained from sampling, which utilizes about 100 weather sequences, and the results obtained from an entire years worth of sequences, finds that the peak consequence values in the sampling distribution are 30% or more below the peak consequences over the entire year, if the plume rotation option is not utilized. Thus there is a significant sampling error for peak values associated with the MACCS2 sampling scheme (and presumably the CRAC2 sampling scheme as well).

We were unable to obtain the meteorological data for the Indian Point site needed for input into MACCS2. Instead, we used a meteorological data file for New York City, the location of the nearest National Weather Service weather monitoring station, that was supplied with the original CRAC2 code. This is the same approach that was taken in the CRAC2 Report, which was ostensibly a site-specific study of the 91 sites where nuclear reactors were located or planned, but did not use meteorological data files specific to those sites. Instead, the study used data derived from 29 National Weather Service stations that were chosen as a representative set of the nations meteorological conditions.49 NRC later had to adopt the same approach, using the New York City meteorological data file as a surrogate for Indian Point-specific data in a CRAC2 benchmark exercise, because it was unable to obtain the Indian Point data.50 Use of the New York City meteorological data file in lieu of Indian Point site data is a reasonable approximation for the purposes of this report. Two of the most important factors in determining the radiological consequences of a terrorist attack at Indian Point are the wind direction and the precipitation. With regard to the first factor, we use the Indian Point site wind rose to take into account the effect of the variation in wind direction.51 With regard to precipitation data, since the MACCS2 code only allows for uniform precipitation over the entire evaluation area, the precipitation data set from New York City is just as relevant as data from the Indian Point site for determining the consequences for the New York metropolitan area.

One phenomenon that we cannot fully account for without access to meteorological data specific to the Indian Point site is the coupling between wind direction and wind speed that results from the plants location in the Hudson River Valley. Wind speeds below a threshold of below 4 meters per second tend to result in plumes that follow the course of the river valley, whereas greater wind speeds produce plumes that are free to travel in any direction and are better approximated by the straight-line Gaussian model. Our use of the 49 R. Davis, A. Hanson, V. Mubayi and H. Nourbakhsh, Reassessment of Selected Factors Affecting Siting of Nuclear Power Plants, NUREG/CR-6295, US Nuclear Regulatory Commission, 1997, p. 3-30.

50 US Nuclear Regulatory Commission, Generic Environmental Impact Statement for License Renewal of Nuclear Plants, NUREG-1437, Vol. 1, Sec. 5.3.3.2.3.

51 James Lee Witt Associates, Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone, March 2003, Figure 3-1, p. 21.

35 Indian Point wind rose accounts for this effect, but to the extent that the distribution of wind speeds in the meteorological data file that we use differs from that at the Indian Point site, the calculations may include some cases that involve unrealistic wind patterns.

However, any errors in the distribution resulting from this approximation are not likely to be significant in comparison to the uncertainties associated with use of the straight-line Gaussian model in MACCS2. In any event, it is likely that properly accounting for this effect would result in the channeling of a greater number of slow-moving, concentrated plumes directly downriver toward densely populated Manhattan, thereby increasing the overall radiological impact.

We have also run the calculations using the meteorological data file for the Surry site in Virginia to compare the maximum consequences obtained. We find that the values for peak early fatalities differ by less than 1% and the value for peak latent cancer fatalities differs by less than 5%. We interpret this result as an indication that the peak consequences we found for Indian Point are not due to weather conditions unique to the meteorological data file for New York City.

If Entergy were willing to provide us with data from the Indian Point meteorological monitoring station, we would be pleased to use it to assess whether it would have a significant impact on our results. However, we would expect any impact to be minor.

(c) Protective actions Another crucial factor in determining the consequences associated with a terrorist attack at Indian Point is the effectiveness of the actions taken to protect individuals within the 10-mile emergency planning zone (EPZ).

The MACCS2 emergency planning model requires the user to input the time when notification is given to emergency response officials to initiate protective actions for the surrounding population; the time at which evacuation begins after notification is received; and the effective evacuation speed. Once evacuation begins, each individual then proceeds in a direction radially outward from the release point at a rate given by the effective evacuation speed.

We have assumed that the time at which the off-site alarm is sounded is coincident with the initiation of core melting; that is, 30 minutes after the attack. It is unlikely that the decision to evacuate could be made in much less time. This choice still provides an interval of 78 minutes between the sounding of the alarm and the initiation of the radiological release, consistent with earlier studies such as the CRAC2 Report.

We have assumed that the delay time between receipt of notification by the public within the EPZ and initiation of evacuation is two hours. This is the default parameter in the MACCS2 code, and is consistent both with earlier estimates of the mobilization time and with the most recent ones for the Indian Point site, which found that 100% of the public within the EPZ would be mobilized to evacuate by two hours after notification.52 52 James Lee Witt Associates (2003), op cit., Figure 5-6, p. 96.

36 The effective evacuation speed was obtained from the mobilization time estimate of two hours and the most recent Indian Point evacuation time estimate (ETE) for good summer weather of 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 25 minutes. 53 Subtracting the two-hour mobilization time leaves a maximum time of 7.42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> for the actual evacuation. Since the maximum travel distance to leave the EPZ is approximately ten miles, this corresponds to an effective evacuation speed of 1.35 miles per hour, or 0.6 meters per second. The high value for the ETE and the correspondingly low effective evacuation speed reflect the severe traffic congestion within the EPZ that is projected to occur in the event that a crisis occurs at Indian Point requiring evacuation.

Outside of the 10-mile EPZ, the baseline dose calculations assume that individuals will take no protective actions.54 Although this may not be realistic, we believe that it would be inappropriate to assume otherwise. Since NRC and FEMA do not require that any preparation for an emergency be undertaken outside of the 10-mile EPZ, it would not be conservative to assume that individuals outside of the EPZ would receive prompt notification of the event or would know what to do even if they did receive notification.

However, to examine the impact of this assumption on the results, we consider a case where the emergency evacuation zone is extended to 25 miles, and the average evacuation speed remains the same as in the 10-mile EPZ case.

(d) Population distribution In order to accurately calculate the consequences of a terrorist attack at Indian Point, it is necessary to have the correct spatial distribution of population in the vicinity of the site.

MACCS2 has the option to use a site population data file, in which the site-specific population is provided on a grid divided into sixteen angular sectors. The user can specify the lengths of sectors in the radial direction.

Most of our analysis is focused on a circular region centered on the Indian Point site with a radius of fifty miles. The ten-mile EPZ is divided into eleven regions, with divisions at the site exclusion zone (about 0.5 miles), at the one-mile point, and nine successive mile-wide intervals. The region between the EPZ and the fifty-mile limit is subdivided into ten intervals (see Figure 1, below).

Permanent resident population data for the ten-mile EPZ was obtained from the estimates for 2003 generated by KLD Associates for the Evacuation Time Estimate study that it prepared for Entergy.55 The total number of permanent residents within a ten-mile circular zone around Indian Point in 2003, according to KLD, was 267,099. We have not included the transient population in the region in our calculations, even though it would add another 25% to the permanent population estimate, according to KLD data.

53 KLD Associates, Inc., Indian Point Energy Center Evacuation Time Estimate, Rev. 0 (2003), p. 7-8.

54 However, the calculation of doses within the EPZ does reflect the impact of shadow evacuation of individuals outside of the EPZ, since it uses the KLD Associates evacuation time estimate for the EPZ, which assumes that shadow evacuation occurs.

55 KLD Associates, Inc. (2003), op cit., p. 3-7.

37 For the region from 10 to 100 miles from Indian Point, the MACCS2 site data file was generated with the SECPOP2000 code, which is the most recent version of the SECPOP code originally developed by the Environmental Protection Agency and later adopted by NRC for use in regulatory applications.56 SECPOP2000 utilizes 2000 US Census data to estimate population distributions on a user-specified grid surrounding any location in the United States, drawing on a high-resolution database of over eight million census-blocks.

By utilizing the 2000 Census data in SECPOP2000, we have slightly underestimated the population in this region, which appears to have increased by about 1% between 2000 and 2003.

The Indian Point plume exposure EPZ is not in the shape of a perfect circle of ten-mile radius, but includes some regions that are beyond ten miles from the plant. To account for the 38,177 individuals that reside within the EPZ but outside of the 10-mile circular zone (according to KLD estimates for 2003), we used the SECPOP2000 code to determine that an effective circular EPZ boundary of 10.68 miles would include the appropriate additional number of permanent residents, and adjusted the MACCS2 grid accordingly.

Figure 1 displays the population rosette generated by SECPOP2000 for Indian Point, out to a distance of 100 miles. The location of New York City is plainly visible on the grid.

FIGURE 1 56 N. Bixler et al., SECPOP2000: Sector Population, Land Fraction, and Economic Estimation Program, NUREG/CR-6525, Rev. 1, Sandia National Laboratories, August 2003.

38 RESULTS In this section, we present the results of the MACCS2 simulation of a terrorist attack at IP2, as previously described.

MACCS2 generates results for two distinct periods following a radiological release. First, it calculates the doses to individuals received during the emergency phase of the event, defined as the period extending up to the first week following the release. The doses received during this period result from direct exposure to and inhalation of the plume, as well as exposure to plume particles deposited on the ground (groundshine). Second, it separately calculates doses received beyond the first week after the release as a result of groundshine, inhalation of resuspended particles, and consumption of contaminated food and water. The first sets of results provided below refer only to the consequences of exposures received during a one-week emergency phase. The economic and long-term health consequences are calculated based on the evaluation of chronic exposures for a period of fifty years following the release, which are dominated by groundshine.

Following the format of the CRAC2 Report summary, our calculation considers several public health and environmental endpoints, including early fatalities, latent cancer fatalities, maximum distance for early fatalities, and total economic costs. The calculations were carried out for each of the 8760 weather sequences in the New York City meteorological data file by rotating the plume direction into each of the 16 sectors of the compass, and then generating a weighted average of the results according to the Indian Point site wind rose. For each endpoint, in addition to the mean of the distribution and the peak value corresponding to the worst-case meteorological conditions encountered during the year, we present the 95th and 99.5th percentile values of the distribution.

The results of the MACCS2 frequency distribution are based on the assumption that the radiological release would occur at random during the year, even though the timing of a terrorist attack most likely would be far from random. As we have previously discussed, one must assume that a terrorist attack intended to cause the maximum number of casualties would be timed to coincide as closely as possible with the most favorable weather conditions. In the case of Indian Point, an attack at night --- the time when a terrorist attack is most likely to be successful --- also happens to be the time when the prevailing winds are blowing toward New York City. Consequently, the mean and other statistical parameters derived from a random distribution are not characteristics of the actual distribution of consequences resulting from a terrorist attack, which would be restricted to a much more limited set of potential release times. A meteorological data set confined to the evening hours would skew the distribution in the direction of increased consequences.

In our judgment, the 95th percentile values of these distributions, rather than the mean values, are reasonable representations of the likely outcome of a well-planned terrorist attack. This choice reflects the fact that the attack time will be largely of the terrorists choosing, but that some factors will necessarily remain out of their control --- for instance,

39 the ability to accurately predict precipitation patterns, and the ability to launch an attack exactly as planned.

In the following tables, it is important to note that the peak results in each category do not correspond in general to the same weather sequence. For example, the weather conditions that lead to the maximum number of early fatalities are typically those that involve rainout and substantial deposition of the plume close to the plant, and thus are not the same conditions that lead to peak latent cancer fatalities, which involve rainout of the plume over New York City.

(a) Consequences of radiological exposures during emergency phase Here we consider the consequences of exposures received during the 7-day emergency phase. We calculate the number of early fatalities (EFs) resulting from acute radiation syndrome, both for the residents of the 10-mile EPZ, who are assumed to evacuate according to the scheme described previously, and for the entire population within 50 miles of the plant. Following the CRAC2 Report, we also provide the early fatality distance, that is, the greatest distance from the Indian Point site at which early fatalities may occur. Finally, we provide an estimate of the number of latent cancer fatalities (LCFs) that will occur over the lifetimes of those who are exposed to doses that are not immediately life-threatening, both for residents of the EPZ and for residents of the 50-mile region.

It is important to note that these estimates are based on dose conversion factors (the radiation doses resulting from internal exposure to unit quantities of radioactive isotopes) appropriate for a uniform population of adults, and do not account for population variations such as age-specific differences. A calculation fully accounting for individual variability of response to radiation exposure is beyond the capability of the MACCS2 code and the scope of this report.

In Table 3, these results are provided for the case in which 100% evacuation of the EPZ occurs, based on the KLD evacuation time estimate and 2-hour mobilization time discussed earlier. Table 4 presents the same information for the case where the EPZ population is sheltered for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to evacuation. Finally, Table 5 presents the results for the extreme case where no special precautions are taken in the EPZ.

In interpreting the results of these tables, one should keep in mind that the MACCS2 code uses different radiation shielding factors for individuals that are evacuating, sheltering or engaged in normal activity. The default MACCS2 parameters (which we adopt in this study) assume that evacuees are not shielded from the radioactive plume by structures, since they are mostly outdoors or in non-airtight vehicles during the evacuation.

Individuals who shelter themselves instead of evacuating are shielded to a considerable extent by structures, but may be exposed to higher levels of radiation overall because they remain in areas closer to the site of plume release. The MACCS2 default shielding parameters assume that sheltering reduces doses from direct plume exposure by 40% and doses from plume inhalation by 67%. The relative benefits of sheltering versus

40 evacuation are obviously quite sensitive to the values of the shielding parameters. Finally, the level of shielding for individuals engaged in normal activity falls in between the levels for evacuation and for sheltering, with reductions in doses from direct plume exposure and plume inhalation relative to evacuees of 25% and 59%, respectively.

TABLE 3: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs),

latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, 100% evacuation of EPZ Mean 95th percentile 99.5th percentile Peak Consequence:

EFs, within EPZ 527 2,440 11,500 26,200 EFs, 0-50 mi.

696 3,460 16,600 43,700 EF distance (mi.)

5.3 18 24 60 LCFs, within EPZ 9,200 31,600 59,000 89,500 LCFs, 0-50 mi.

28,100 99,400 208,000 518,000 TABLE 4: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs),

latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, 24-hour sheltering in EPZ Mean 95th percentile 99.5th percentile Peak Consequence:

EFs, within EPZ 626 2,550 6,370 13,000 EFs, 0-50 mi.

795 3,250 10,200 38,700 EF distance (mi.)

6.2 18 24 60 LCFs, within EPZ 3,770 9,920 12,100 19,400 LCFs, 0-50 mi.

22,700 81,000 192,000 512,000

41 TABLE 5: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs),

latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, normal activity in EPZ Mean 95th percentile 99.5th percentile Peak Consequence:

EFs, within EPZ 4,050 12,600 22,300 38,500 EFs, 0-50 mi.

4,220 13,500 27,300 71,300 EF distance (mi.)

9 18 24 60 LCFs, within EPZ 4,480 10,400 12,500 20,300 LCFs, 0-50 mi.

23,400 82,600 193,000 516,000 A comparison of Tables 3 and 4 indicates that sheltering instead of evacuation results in slightly higher mean early fatalities, but substantially lower 99.5th percentile and peak values. A possible interpretation of this counterintuitive result is that the higher percentile early fatality results for the evacuation case correspond to rare situations in which people evacuate in such a manner as to maximize their radiation exposure (for instance, if they are unfortunate enough to be traveling directly underneath the radioactive plume at the same speed and in the same direction). These situations cannot occur for the sheltering case. Overall, sheltering does appear to substantially reduce the projected number of latent cancer fatalities within the EPZ relative to evacuation, for the default MACCS2 shielding parameters.

A comparison of Table 5 to Tables 3 and 4 indicates that either evacuation or sheltering would substantially reduce the number of early fatalities within the EPZ relative to a case where no protective actions are taken. Also, by comparing Tables 3 and 5, one sees that the number of latent cancer fatalities in the EPZ is considerably lower for the normal activity case than for the evacuation case. There are two reasons for this. First, many evacuees will receive doses that are not high enough to cause early fatalities, yet will contribute to their lifetime cancer risk. In the normal activity case, some of these individuals will receive higher doses and succumb to acute radiation syndrome instead.

Second, the MACCS2 default shielding factors give considerable protection to individuals engaged in normal activity compared to evacuees, and may not be realistic.57 The peak numbers of latent cancer fatalities for all three cases in the 50-mile zone are disturbingly high, and are more than double the number in the 99.5th percentile. But an examination of the particular weather sequence corresponding to this result indicates that 57 The protection due to shielding has a bigger impact on the number of latent cancer fatalities, which is a linear function of population dose, than on the number of early fatalities, which is a non-linear function of dose. Shielding would only prevent early fatalities for those individuals whose acute radiation doses would be lowered by sheltering from above to below the early fatality threshold.

42 the rarity of the event is an artifact of the meteorological data file that we have used, and not a consequence of very extreme or unusual weather conditions for the New York City region. We are not disclosing the details of this weather sequence.

The reader may also notice that the values for the early fatality distance for the 95th percentile and above are the same in Tables 3-5, but the mean values are not. This is because the distances for the 95th percentile and above are all greater than 10 miles, so that they are not affected by differences in protective actions that apply only within the 10-mile EPZ.

(b) Doses received by individuals outside of the 10-mile EPZ It is clear from the previous section that direct exposure to the radioactive plume resulting from a terrorist attack at Indian Point could have severe consequences well beyond the 10-mile EPZ, yet there is no regulatory requirement that local authorities educate residents outside of the EPZ about these risks, or undertake emergency planning to protect these individuals from plume exposures. Therefore, individuals who are now at risk do not have the information that they may need to protect themselves. This is a shortsighted policy, and in fact is inconsistent with government guidelines for protective actions in the event of a radiological emergency.

In this section, we calculate the plume centerline thyroid doses to adults and five-year-old children, and the plume centerline whole-body doses to adults, both at the EPZ boundary and in midtown New York City. (For a given distance downwind of a release, the maximum dose is found at the plume centerline.) We then compare these values to the appropriate protective action recommendations. Thyroid doses are compared to the dose thresholds in the most recent FDA recommendations for potassium iodide administration and whole-body doses are compared to the EPA protective action guides (PAGs) for emergency-phase evacuation. In both cases, the plume centerline doses received to individuals in New York City are well in excess of the projected dose thresholds that would trigger protective actions.

(i) Thyroid doses to children, their consequences, and the need for KI distribution The statistically significant increase in the incidence of thyroid cancer observed among children exposed to fallout from the Chernobyl disaster leaves little doubt of the causal relationship between the occurrence of these cancers and the massive release of radioactive iodine to the environment resulting from the accident.58 The effectiveness of widespread distribution of stable iodine in the form of potassium iodide (KI) to block uptake of radioactive iodine in the thyroid was also confirmed in western areas of Poland, where the timely administration of KI was estimated to have reduced peak doses from radioactive iodine by 30%.59 58 D. Williams, Cancer After Nuclear Fallout: Lessons from The Chernobyl Accident, Nature Reviews Cancer 2 (2002), p. 543-549.

59 Board on Radiation Effects Research, National Research Council, Distribution and Administration of Potassium Iodide in the Event of a Nuclear Incident, National Academies Press, 2003, p. 58.

43 In the United States, after resisting public demands for many years, the Nuclear Regulatory Commission finally agreed in January 2001 to amend its emergency planning regulations to explicitly consider the use of KI, and to fund the purchase of KI for distribution within the 10-mile plume exposure EPZs of nuclear plants in states that requested it. This effort accelerated after the September 11 attacks, as more states requested the drug, but even today only fewer than two-thirds of the 34 states and tribal governments that qualify for the KI purchase program have actually stockpiled it. New York State is one of the participants.

Despite a few attempts in Congress after September 11 to require the distribution of KI in areas outside of the plume exposure EPZs, the 10-mile limit remains in effect today, and NRC continues to defend it. In a recent Commission meeting on emergency planning, NRC employee Trish Milligan said that60 the [NRC] staff has concluded that recommending consideration of potassium iodide distribution out to 10 miles was adequate for protection of the public health and safety.

Earlier in this briefing, Ms. Milligan provided evidence of the NRC staffs thinking that led to this conclusion:61 When the population is evacuated out of the [10-mile] area and potentially contaminated foodstuffs are interdicted, the risk from further radioactive iodine exposure to the thyroid gland is essentially eliminated.

These statements again show that NRC continues to use design-basis accidents, in which the containment remains intact, as the model for its protective action recommendations.

Although NRC claims that its emergency planning requirements take into account all potential releases, including those resulting from terrorist acts, it clearly is not taking into account catastrophic events such as the scenario being analyzed in this report.

These statements also suggest that NRC is committing the fallacy of using the pattern of radioactive iodine exposure that occurred after the Chernobyl accident as the model for the pattern that could occur here. In the Chernobyl event, the majority of the thyroid dose to children occurred through ingestion of contaminated milk and other foodstuffs that were not interdicted due to the failure of the Soviet authorities to act in a timely manner.

However, the food pathway dominated in that case primarily because of the extremely high elevation of the Chernobyl plume, which reduced the concentration of radioactive iodine in the plume and therefore the doses received through direct inhalation.

But as pointed out earlier, the plume from a severe accident at a water-moderated PWR like Indian Point would probably not rise as high as the Chernobyl plume, and the associated collective thyroid dose would have a greater contribution from direct plume inhalation and a lower contribution from milk consumption. In this case, the importance 60 US NRC, Briefing on Emergency Preparedness Program Status (2003), transcript, p. 21.

61 Ibid, p.19.

44 of KI prophylaxis would increase relative to that of milk interdiction for controlling overall population exposure to radioactive iodine.

Our calculations clearly indicate that a severe threat to children from exposure to radioactive iodine is present far beyond the 10-mile EPZ where KI is now being made available. In Table 6, we present some results of the distribution for plume centerline thyroid dose to both adults and to five-year-old children at the EPZ boundary and in midtown Manhattan (32.5 miles downwind). In the last column, we provide the projected dose thresholds from the most recent guidelines issued by the FDA for KI prophylaxis.

The thyroid dose to five-year-olds due to I-131 internal exposure was calculated by using the age-dependent coefficients for dose per unit intake provided in ICRP 72, which are approximately a factor of five greater than those for adults. The calculation must also take into account the difference in the rate of intake of air for children and for adults.

Children have lower lung capacities than adults, but they have higher metabolic rates and therefore breath more rapidly. The higher breathing rate of children tends to partially offset their lower lung capacity. Data collected by the California Environmental Protection Agency indicates that on average, children consume air at a rate about 75% of that of adults.62 We have used this figure in our calculation.

TABLE 6: Terrorist attack at IP 2, MACCS2 estimates of centerline thyroid doses to 5-year-olds resulting from emergency phase exposures (all doses in rem)

Mean 95th percentile 99.5th percentile Peak FDA KI threshold Location Age Adult 1,120 3,400 5,850 9,560 10 (ages 18-40) 500 (over 40)

Outside EPZ (11.6 mi) 5 years 3,620 10,900 18,000 32,100 5 Adult 164 429 761 1,270 10 (ages 18-40) 500 (over 40)

Midtown Manhattan (32.5 mi) 5 years 530 1,310 2,500 4,240 5

The results in Table 6 show that the thyroid doses to 5-year-olds are approximately three times greater than those for adults. This tracks well with information in the World Health Organizations 1999 guidelines for iodine prophylaxis, which states that thyroid doses from inhalation in children around three years old will be increased up to threefold relative to adults.63 62 Air Resources Board, California Environmental Protection Agency, How Much Air Do We Breathe?,

Research Note #94-11, August 1994. On the Web at www.arb.ca.gov/research/resnotes/notes/94-11.htm.

63 World Health Organization, Guidelines for Iodine Prophylaxis Following Nuclear Accidents, WHO, Geneva, 1999, Sec. 3.3.

45 These results make clear that both 95th percentile and mean projected thyroid doses can greatly exceed the FDA-recommended threshold for KI prophylaxis administration at locations well outside the 10-mile EPZ, for 5-year-old children and for adults of all ages.

In Manhattan, KI would be recommended for children and adults under 40, based on the 95th percentile projection.

The health consequences of doses of this magnitude to the thyroid would be considerable.

As the 99.5th percentile is approached, the 5-year-old doses are high enough to cause death of thyroid tissue. In fact, they are on the order of the doses that are applied therapeutically to treat hyperthyroidism and other diseases by destroying the thyroid gland. Children with this condition would require thyroid hormone replacement therapy for their entire lives. At lower doses, in which cells are not killed but DNA is damaged, the risk of thyroid cancer to children would be appreciable. According to estimates obtained from Chernobyl studies, a 95th percentile thyroid dose of 1,310 rem to a 5-year-old child in Manhattan would result in an excess risk of about 0.3% per year of contracting thyroid cancer.64 Given that the average worldwide rate of incidence of childhood thyroid cancer is about 0.0001% per year, this would represent an impressive increase.

These results directly contradict the reassuring statements by NRC quoted earlier. But it is no secret to NRC that such severe thyroid exposures can occur as the result of a catastrophic release. Results very similar to these were issued by NRC staff in 1998 in the first version of a draft report on the use of KI, NUREG-1633.65 This draft included a Section VII entitled Sample Calculations, in which the NRC staff estimated the centerline thyroid doses at the 10-mile EPZ boundary from severe accidents using the RASCAL computer code. Table 5 of the draft report shows that the NRCs calculated dose to the adult thyroid at the 10-mile limit ranged from 1500 to 19,000 rem for severe accidents with iodine release fractions ranging from 6 to 35%, for a single weather sequence.66 In the introductory section, the report states that doses in the range of 25,000 rad are used to ablate thyroids as part of a therapeutic procedure. Such thyroid doses are possible during severe accidents.67 NRCs results are even more severe than ours, which were obtained using the NRC revised source term, with a higher iodine release fraction of 67%.

Given NRCs reluctance to provide information of this type to the public, it is no surprise that the Commission withdrew the draft NUREG-1633 and purged it from its web site, ordering the issuance of a substantially revised document taking into account the many useful public comments that it received.68 Lo and behold, the second draft of 64 The average excess absolute risk per unit thyroid dose for children exposed to Chernobyl fallout has been estimated 2.1 per million children per rad. D. Williams, op cit., p. 544.

65 F.J. Congel et al., Assessment of the Use of Potassium Iodide (KI) As A Public Protective Action During Severe Reactor Accidents, Draft Report for Comment, NUREG-1633, US Nuclear Regulatory Commission, July 1998.

66 Ibid, p. 26.

67 Ibid, p. 6.

68 US NRC, Staff Requirements --- Federal Register Notice on Potassium Iodide, SRM-COMSECY 016, September 30, 1998.

46 NUREG-1633, which was rewritten by Trish Milligan and reissued four years later, mysteriously failed to include Section VII, Sample Calculations, as well as all information related to those calculations (such as the clear statement cited earlier that thyroid doses in the range of 25,000 rad are possible during severe accidents).69 This took place even though the Commissions public direction to the NRC staff on changes to be incorporated into the revision made no explicit reference to this section.70 However, it is clear that the expurgated information would be inconsistent with NRCs previous rulemaking restricting consideration of KI distribution only to the 10-mile zone. Even after this exercise in censorship, the Commission still voted in 2002 to block release of the revised draft NUREG-1633 as a final document.

Some insight into the level of understanding of the health impacts of a catastrophic release of radioactive iodine of the current Commission can be found in the statement of Commissioner McGaffigan in voting to delay release of the revised NUREG-1633 for public comment. In his comments, McGaffigan wrote71 Both WHO [the World Health Organization] and FDA set the intervention level on KI prophylaxis for those over 40 at 5 gray (500 rem) to the thyroid Since we do not expect, even in the worst circumstances, any member of the public to receive 500 rem to the thyroid, it would be useful for FDA to clarify whether we should plan for KI prophylaxis for those over 40. [Emphasis added.]

This statement is not consistent with what is known about the potential consequences of a severe nuclear accident. Few experts would claim that such high doses cannot occur even in the worst circumstances, and the NRCs own emergency planning guidance is not intended to prevent such doses in all accidents, but only in most accidents. Given that the Commissioner presumably read the first draft of NUREG-1633, he would have seen the results of the staffs thyroid dose calculations and other supporting material. There is no discussion in the public record that provides a rationale for Commissioner McGaffigans rejection of the informed judgment and quantitative analysis of his technical staff.

In 2003, at the request of Congress a National Research Council committee released a report addressing the issue of distribution and administration of KI in the event of a nuclear incident.72 Most notably, the committee concluded that73

1. KI should be available to everyone at risk of significant health consequences from accumulation of radioiodine in the thyroid in the event of a radiological incident 69 US NRC, Status of Potassium Iodide Activities, SECY-01-0069, Attachment 1 (NUREG-1633, draft for comment; prepared by P.A. Milligan, April 11, 2001).

70 US NRC, SRM-COMSECY-98-016.

71 US NRC, Commission Voting Record on SECY-01-0069, Status of Potassium Iodide Activities, June 29, 2001.

72 National Research Council (2003), op cit.

73 Ibid, p. 5.

47

2. KI distribution programs should consider local stockpiling outside the emergency planning zone While the committee did not itself take on the politically sensitive question of how to determine the universe of individuals who would be at risk of significant health consequences, it did recommend that the decision regarding the geographical area to be covered in a KI distribution program should be based on risk estimates derived from calculations of site-specific averted thyroid doses for the most vulnerable populations.74 This is the type of information that we provide in Table 6 (and the type that NRC struck from draft NUREG-1633). We hope that the information in our report provides a starting point for state and local municipalities to determine the true extent of areas that could be significantly affected by terrorist attacks at nuclear plants in their jurisdiction and to make provisions for availability of KI in those regions. Our calculations show that New York City should be considered part of such an area.

However, even timely administration of KI to all those at risk can only reduce, but cannot fully mitigate, the consequences of a release of radioactive iodine resulting from a terrorist attack at Indian Point. The projected dose to individuals who undergo timely KI prophylaxis can be reduced by about a factor of 10. A review of the results of Table 6 shows that doses and cancer risks to many children in the affected areas will still be high even after a ten-fold reduction in received dose. And KI can only protect people from exposure to radioactive iodine, and not from exposure to the dozens of other radioactive elements that would be released to the environment in the event of a successful attack.

(ii) Whole-body doses and the need for evacuation or sheltering In addition to KI distribution, the other major protective action that will be relied on to reduce exposures following a terrorist attack at Indian Point is evacuation of the population at risk. In Table 7, we present the results of our calculation for the projected centerline whole-body total effective dose equivalents (TEDEs) just outside the EPZ boundary and in downtown Manhattan, and compare those with the EPA recommended dose threshold for evacuation during the emergency phase following a radiological incident. As in the discussion of projected thyroid doses and KI prophylaxis, we find that projected centerline TEDEs would exceed the EPA Protective Action Guide (PAG) for evacuation of 1-5 rem at distances well outside of the 10-mile plume exposure EPZ within which NRC requires evacuation planning.

74 Ibid, p. 162.

48 TABLE 7: Terrorist attack at IP 2, MACCS2 estimates of adult centerline whole-body total effective dose equivalents (TEDEs) resulting from emergency phase exposures (all doses in rem)

Mean 95th percentile 99.5th percentile Peak EPA PAG Location EPZ boundary (11.6 mi) 198 549 926 1,490 1-5 Midtown Manhattan (32.5 mi) 30 77 131 307 1-5 From the results in Table 7, it is clear that according to the EPA early phase PAG for evacuation of 1-5 rem, evacuation would be recommended for individuals in the path of the plume centerline not only outside of the EPZ boundary, but in New York City and beyond. An individual in Manhattan receiving the 95th percentile TEDE of 77 rem during the emergency phase period would have an excess absolute lifetime cancer fatality risk of approximately 8%, which corresponds to a 40% increase in the lifetime individual risk of developing a fatal cancer (which is about one in five in the United States).

We now examine the potential reduction in health consequences that could result from evacuation of a larger region than the current 10-mile EPZ by considering a case in which the boundary of the plume exposure EPZ is expanded from 10.7 to 25 miles. We calculate the impact of different protective actions in this region on the numbers of early fatalities and latent cancer fatalities among the population within the expanded EPZ but outside of the original 10-mile EPZ. The residents of the expanded EPZ are assumed either (1) to evacuate with the same mobilization time and at the same average speed as the residents of the original EPZ, or (2) to shelter in place for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and then evacuate.

The results are provided in Table 8.

TABLE 8: Terrorist attack at IP 2, MACCS2 95th percentile estimates of early fatalities (EFs) and latent cancer fatalities (LCFs) resulting from emergency phase exposures; 25-mile EPZ Normal activity Evacuation Sheltering for 24 hrs Consequence:

EFs, 10.7-25 mi 664 0

0 LCFs, 10.7-25 mi 19,800 45,700 9,020

49 These results indicate that evacuation and sheltering are equally effective in eliminating the risk of early fatalities among residents of the 10.7-25 mile region for the 95th percentile case. On the other hand, one sees that evacuation also tends to increase the number of latent cancer fatalities relative to normal activity, while sheltering reduces the number. Thus for this scenario, it appears that sheltering of individuals in the 10.7-25 mile region would be preferable to evacuation of this region for the MACCS2 evacuation and sheltering models we use here. This is consistent with the results we obtained earlier when considering the comparative impacts of evacuation and sheltering of residents of the 10-mile EPZ, again indicating that evacuation tends to increase population doses by placing more people in direct contact with the radioactive plume. However, other models and other shielding parameter choices may lead to different conclusions. We would urge emergency planning officials to evaluate an exhaustive set of scenarios, and to conduct a realistic and site-specific assessment of the degrees of shielding that structures in the region may provide, to determine what types of actions would provide the greatest protection for residents of regions outside of the 10-mile EPZ.

(c) Long-term economic and health consequences In this section we provide MACCS2 order-of-magnitude estimates of the economic costs of the terrorist attack scenario, the numbers of latent cancer fatalities resulting from long-term radiation exposures (primarily as a result of land contamination), and the number of people who will require permanent relocation. NRC has used MACCS2 to estimate the economic damages of reactor accidents for various regulatory applications.75 There is no unique definition of the economic damages resulting from a radiological contamination event. In the MACCS2 model, which is a descendant of the CRAC2 model, the total economic costs include the cost of decontamination to a user-specified cleanup standard, the cost of condemnation of property that cannot be cost-effectively decontaminated to the specified standard, and a simple lump-sum compensation payment to all members of the public who are forced to relocate either temporarily or permanently as a result of the attack. Although simplistic, this model does provide a reasonable estimate of the order of magnitude of the direct economic impact of a successful terrorist attack at Indian Point.

(i) EPA Protective Action Guide cleanup standard We first employ the long-term habitability cleanup standards provided by the EPA protective action guide (PAG) for the intermediate phase, which is the period that begins after the emergency phase ends, when releases have been brought under control and accurate radiation surveys have been taken of contaminated areas. The EPA intermediate phase PAG recommends temporary relocation of individuals and decontamination if the projected whole-body total effective dose equivalent (TEDE) (not taking into account any shielding from structures) over the first year after a radiological 75 US NRC, Office of Nuclear Regulatory Research, Regulatory Analysis Technical Evaluation Handbook, NUREG/BR-0184, January 1997, p. 5.37.

50 release would exceed 2 rem. The EPA chose this value with the expectation that if met, then the projected (shielded) TEDE in the second (and any subsequent year) would be below 0.5 rem, and the cumulative TEDE over a fifty-year period would not exceed 5 rem.

The MACCS2 economic consequence model evaluates the cost of restoring contaminated areas to habitability (which we define as reducing the unshielded TEDE during the first year of reoccupancy to below 2 rem), and compares that cost to the cost of condemning the property. All cost parameters, including the costs of decontamination, condemnation and compensation, can be specified by the user. We employ an economic model partly based on parameters developed for a recent study on the consequences of spent fuel pool accidents.76 The model utilizes the results of a 1996 Sandia National Laboratories report that estimates radiological decontamination costs for mixed-use urban areas.77 We refer interested readers to these two references for information on the limitations and assumptions of the model.

The SECPOP2000 code, executed for the Indian Point site, provides the required site-specific inputs for this calculation, including the average values of farm and non-farm wealth for each region of the MACCS2 grid, based on 1997 economic data. These values are used to assess the cost-effectiveness of decontaminating a specific element versus simply condemning it.

Table 9 presents the long-term health and economic consequences calculated by MACCS2 for a region 100 miles downwind of the release, considering only costs related to residential and small business relocation, decontamination and compensation. Since the calculation was performed using values from a 1996 study and from 1997 economic data, we have converted the results to 2003 dollars using an inflation adjustment factor of 1.10. Because of significant uncertainties in the assignments of parameters for this calculation, the results in Table 9 should only be regarded as order-of-magnitude estimates. The reader should note that the latent cancer fatality figures in Table 9 result from doses incurred after the one-week emergency phase is over, and therefore are additional to the numbers of latent cancer fatalities resulting from emergency-phase exposures reported previously in Tables 3 to 5.

76 J. Beyea, E. Lyman and F. von Hippel, Damages from a Major Release of 137Cs into the Atmosphere of the United States, Science and Global Security 12 (2004) 1-12.

77 D. Chanin and W. Murfin, Site Restoration: Estimates of Attributable Costs From Plutonium Dispersal Accidents, SND96-0057, Sandia National Laboratories, 1996.

51 TABLE 9: Terrorist attack at IP 2, MACCS2 estimates of long-term economic and health consequences, EPA intermediate phase PAG (< 2 rem in first year; approx. 5 rem in 50 yrs)

Mean 95th percentile 99.5th percentile Peak Consequence Total cost, 0-100 mi (2003 $)

$371 billion $1.17 trillion

$1.39 trillion

$2.12 trillion People permanently relocated 684,000 3.19 million 7.91 million 11.1 million LCFs, 0-100 mi 12,000 41,200 57,900 84,900 Plume Centerline 50-year TEDE (rem) 4.57 7.04 7.18 7.42 One can see from Table 9 that imposition of the EPA intermediate phase PAG does result in restricting the mean 50-year cumulative TEDE to below 5 rem, but that this limit is exceeded for the higher percentiles of the distribution. Thus for a terrorist attack at the 95th percentile, the subsidiary goal of the EPA intermediate phase PAG is not met.

(ii) Relaxed cleanup standard In the recent NRC meeting on emergency planning described earlier, NRC staff and Commissioners questioned claims by activists that a severe nuclear accident would render large areas permanently uninhabitable, arguing that the radiation protection standard underlying that determination is too stringent compared to levels of natural background radiation to which people are already exposed.

For instance, Trish Milligan said that78 Theres been a concern that a radioactive release as a result of a nuclear power plant accident will render thousands of square miles uninhabitable around a plant.

It is true that radioactive materials can travel long distances. But it is simply not true that the mere presence of radioactive materials are [sic] harmful the standard applied to this particular claim has been a whole body dose of 10 rem over 30 years, or approximately 330 millirem per year. This dose is almost the average background radiation dose in the United States which is about 360 millirem per year. Some parts of the country have a background radiation dose two or more times higher than the national average. So in effect this additional 330 millirem dose is an additional year background dose or the difference in dose 78 US NRC, Briefing on Emergency Preparedness (2003), op cit., transcript, p. 22.

52 between someone living in a sandy coastal area or someone living in the Rocky Mountains.

Ms. Milligan does not note that her opinion of an acceptable level of radiation is not consistent with national standards, such as the EPA PAGs. The EPA long-term goal of limiting chronic exposures after a radiological release to 5 rem in 50 years corresponds to an average annual exposure of 100 millirem above background, while she implies that even a standard of 330 millirem per year, which would double the background dose on average, is unnecessarily stringent.

However, we can evaluate the impact of weakening the EPA PAGs for long-term exposure on costs and risks. In Table 10, we assess the impact of adopting a long-term protective action guide of 25 rem in 50 years, or an average annual dose of 500 millirem per year. By comparing the 95th percentile columns in Table 10 and Table 9, one can see that relaxing the standard would modestly reduce the post-release cleanup costs by about 25% and drastically reduce the number of relocated individuals by 90%. However, weakening the standard would nearly triple the number of long-term cancer deaths among residents of the contaminated area. Cost-benefit analyses of proposals to weaken long-term exposure standards should take this consequence into account.

TABLE 10: Long-term economic and health consequences of a terrorist attack at IP 2, relaxed cleanup standard (25 rem in 50 years)

Mean 95th percentile 99.5th percentile Peak Consequence:

Total cost, 0-100 mi (2003 $)

$249 billion $886 billion

$1.14 trillion

$1.50 trillion People permanently relocated 118,000 334,000 1.86 million 7.98 million LCFs, 0-100 mi 36,300 115,000 169,000 279,000 (d) An even worse case The previous results were based on the analysis of a terrorist attack that resulted in a catastrophic radiological release from only one of the two operating reactors at the Indian Point site. However, it is plausible that both reactors could be attacked, or that an attack on one could result in the development of an unrecoverable condition at the other. Here we present the results of a scenario in which Indian Point 3 undergoes a similar accident sequence to Indian Point 2 after a time delay of just over two hours. This could occur, for example, if Indian Point 3 experienced a failure of its backup power supplies at the time that Indian Point 2 was attacked. Given the loss of off-site power at the same time, Indian Point 3 could experience a small-break LOCA and eventually a core melt, commencing about two hours after accident initiation. We assume that the attackers

53 weaken the IP3 containment so that it ruptures at the time of vessel failure. In Table 11, we present the results of this scenario for the case of full evacuation of the EPZ.

As bad as this scenario is, it still does not represent the worst case. If any or all of the three spent fuel pools at the Indian Point site were also damaged during the attack, the impacts would be far greater, especially with regard to long-term health and economic consequences.

TABLE 11: Terrorist attack at IP 2 and 3, MACCS2 estimates of early fatalities (EFs) and latent cancer fatalities (LCFs) resulting from emergency phase exposures, 100% evacuation of EPZ Mean 95th percentile 99.5th percentile Peak Consequence:

EFs, within EPZ 925 4,660 18,400 34,100 EFs, 0-50 mi.

1,620 8,580 30,900 78,400 EF, distance (mi.)

9.1 21 29 60 LCFs, within EPZ 14,800 42,900 75,100 122,000 LCFs, 0-50 mi.

53,400 180,000 342,000 701,000

54 CONCLUSIONS In conclusion, we make the following observations.

1) The current emergency planning basis for Indian Point provides insufficient protection for the public within the 10-mile emergency planning zone in the event of a successful terrorist attack. Even in the case of a complete evacuation, up to 44,000 early fatalities are possible.

2) The radiological exposure of the population and corresponding long-term health consequences of a successful terrorist attack at Indian Point could be extremely severe, even for individuals well outside of the 10-mile emergency planning zone. We calculate that over 500,000 latent cancer fatalities could occur under certain meteorological conditions. A well-developed emergency plan for these individuals, including comprehensive distribution of potassium iodide throughout the entire area at risk, could significantly mitigate some of the health impacts if promptly and effectively carried out.

However, even in the case of 100% evacuation within the 10-mile EPZ and 100%

sheltering between 10 and 25 miles, the consequences could be catastrophic for residents of New York City and the entire metropolitan area.

3) The economic impact and disruption for New York City residents resulting from a terrorist attack on Indian Point could be immense, involving damages from hundreds of billions to trillions of dollars, and the permanent displacement of millions of individuals.

This would dwarf the impacts of the September 11 attacks.

4) The potential harm from a successful terrorist attack at Indian Point is significant even when only the mean results are considered, and is astonishing when the results for 95th and 99.5th meteorological conditions are considered. Given the immense public policy implications, a public dialogue should immediately be initiated to identify the protective measures desired by the entire affected population to prevent such an attack or effectively mitigate its consequences should prevention fail. As this study makes abundantly clear, this population extends far beyond the 10-mile zone that is the focus of emergency planning efforts today.

We hope that this information will be useful for officials in the Department of Homeland Security as it carries out its statutory requirement to conduct a comprehensive assessment of the terrorist threat to the US critical infrastructure, as well as for health and emergency planning officials in New York City and other areas that are not now currently engaged in emergency preparedness activities related to a terrorist attack at Indian Point.

ACKNOWLEDGMENTS The author would like to thank David Lochbaum, Kenneth Bergeron, Frank von Hippel, Jan Beyea and Lisbeth Gronlund for reading drafts of this report and providing many useful comments and suggestions. All mistakes are the responsibility of the author.