ML20045B782

Provides Commission W/Recommendation Re Need to Modify Design Basis Threat for Radiological Sabotage to Include Use of Land Vehicles by Adversaries,For Transporting Personnel, hand-carried Equipment &/Or Explosives

ML20045B782
Person / Time
Issue date:	06/14/1993
From:	Taylor J NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:
References
FRN-59FR38889 AE81-2, AE81-2-082, AE81-2-82, SECY-93-166, NUDOCS 9306210075
Download: ML20045B782 (44)

Text

- _ _ _ _ _ _ _ _

,f... g A RfC p

D1

,j.

%,.%> }

POLICY ISSUE June 14, 1993 Otation Vote)

SECY-93-166 FOR:

The Commissioners FROM:

James M. Taylor Executive Director for Operations

SUBJECT:

STAFF RECOMMENDATION FOR PROTECTION AGAINST MALEVOLENT USE OF VEHICLES AT NUCLEAR POWER PLANTS PURPOSE:

To provide to the Commission a recommendation regarding the.need to modify the design basis threat (DBT) for radiological sabotage to include use of land vehicles by adversaries, for transporting personnel, hand-carried equipment and/or explosives. The Commission is reminded that Phase 2 and.a. review of the other attributes of the DBT also are underway, as described in my March 11, 1993, memorandum to the Commission. The.results of Phase 2 will be provided upon its completion.

SUMMARY

In response to the Staff Requirements Memorandum (SRM) of May 5, 1993, the-Commission paper provides five options and a recommendation for protection-against malevolent use of vehicles at nuclear power plants.

In addition, information is provided regarding:

1) industry.'s estimate of the costs to implement the various options, 2) the cost of present security at nuclear power plants, and 3) current industry initiatives to address the vehicle threat, independent of the Nuclear Regulatory Commission.

Regarding the threat environment, staff concluded that there is no indication of an actual vehicle threat against the domestic commercial nuclear industry.

Nonetheless, in light of the vehicle intrusion at Three Mile Island (THI). and

Contact:

John Davidson, NMSS 504-2465 NOTE:

TO BE.MADE PUBLICLY AVAILABLE Phillip McKee, NRR WHEN THE FINAL SRM IS MADE 504-2933 AVAILABLE 010052 V,.

j m.

O sc w oc_s,97 3~ W 9 a

4;.

7 LThe' Commissioners 2

l the World Trade Center vehicle bombing, staff believes that a. vehicle.

intrusion or. bomb threat to a nuclear power plant could develop without warning'in.the future. Accordingly, to maintain a prudent margin between what is. the. current threat estimate (low) and the DBT-(higher), staff proposes a-modification of the DBT for radiological sabotage to include protection r

against malevolent use of vehicles at nuclear power _ plants.

L The paper recommends:

1) a modification to the DBT for radiological. sabotage (10 CFR 73.1) to include a land vehicle for the transport of-personnel,- hand-carried equipment', and/or explosives, 2) appropriate modifications to 10 CFR. 73.55 to reflect thel change to the DBT and to allow for consideration of reasonable alternative security measures when establishing stand-off distance, and 3) an expedited rulemaking to achieve this change. :A Design Basis Vehicle (DBV) threat described in terms of vehicle characteristics and' explosive device is forwarded under separate cover as Safeguards Information.

BACKGROUND:

At the April 22, 1993,. Commission meeting on SECY-93-102, staff reviewed past Commission deliberations on the vehicle. threat'and presented four; proposed _

i options with cost estimates in response to the current: evaluation..0ption 1 was to take no action. Option 2 would require. vehicular! intrusion _ protection.

at existing protected area vehicle access points and some_ distance.on each 1

side of those access points. Option 3 would require. vehicular intrusion-protection around the entire protected area perimeter.. Option 4 would. require protection against some specified'DBV and explosive charge'.

In addition.to the proposed options, staff noted that absent an _immediate actual vehicle threat, a staff recommendation on which of the four proposed' options the l

. Commission should adopt, would be delayed until after the May 10, 1993, public meeting on the DBT. This delay would permit staff consideration of public input.

(

The SRM of May 5, 1993, in addition to requesting a staff recommendation on' the vehicle threat, directed staff to' provide information;regarding:

1) contingency planning requirements for non-power reactors, 2) industry's

- 1 estimate of_the costs to implement the.various options identified above, l

-3) the. cost of present security at nuclear power plants,7and 4) current industry initiatives _ to address. the vehicle threat, independent of the.NRC.

Information on contingency planning requirements.for non-power reactors.is being provided to.the Commission by separate correspondence. 'Information on cost of security at nuclear power plants in addition to_that provided in j

NUMARC's May 27, 1993 letter, and information on' current industry initiatives i

to address the vehicle threat _are provided in Enclosure 1.

Information on~

j industry's estimate of_.the costs to_ implement the_various options and cost of security at nuclear power plants was-provided by the Nuclear Management and Resources Council (NUMARC) in a May 27, 1993 letter to the NRC (Enclosure 2).

j 4

j g

3 s

q

l The Commissioners 3

i DISCUSSION:

In evaluating the four proposed options, staff csnsidered the following factors in developing its recommendation to the Commission:

Threat Environment The staff continually monitors and evaluates the threat environment worldwide.

In addition, the Commission was briefed by the Central Intelligence Agency and the Federal Bureau of Investigation on March 5,1993. Neither agency provided information regarding an actual vehicle threat to domestic commercial nuclear power reactors that could serve as the basis for modifying the DBT.

Further, staff reported on its analysis of more than 500 vehicle bomb attacks world-wide. Although, based on current information, there is no significant change in the threat environment, the bombing at the World Trade Center demonstrated that a large explosive device could be assembled, delivered to a public area, and detonated in the United States (U.S.) without advance intelligence knowledge.

In addition, the unauthorized intrusion at TMI demonstrated that a vehicle could be used to gain quick access to protected areas of the plant.

Consequently, the staff has concluded that a modification to the DBT is warranted.

The DBT is not intended to represent a real threat.

It serves three purposes.

It provides a standard with which to measure changes in the real threat environment.

It is used to develop regulatory requirements. And it provides a standard for evaluation of implemented safeguards systems.

In assessing the impact on the DBT of the e"ents at TMI and the World Trade Center, staff has considered the following two issues:

first, whether these events establish the need for NRC to revise its regulations to redefine adequate protection of the health and safety of the public, in the sense that adequate protection is used by Section 182 of the Atomic Energy Act; and second, whether these events demonstrate that amending NRC's regulations to protect against malevolent use of a vehicle at nuclear power plants would result in a substantial increase in the overall protection of the public health and safety. With respect to the first issue, the NRC cannot consider cost. With respect to the second issue, the NRC must determine that the direct and indirect costs of implementation are justified in view of the increased protection.

The staff's assessment as to whether to redefine adequate protection is as follows:

With respect to vehicle intrusions, the NRC interpretation of.the DBT for radiological sabotage does not preclude adversaries' use of vehicles, other than vehicle bombs, for transportation and for breaching protected area barriers. The vehicle should be detected by an intrusion

The Commissioners 4

detection system as it enters the protected area. The nature of the threat should be assessed using closed circuit television (CCTV) or other means.

Responding security officers should be able to neutralize the threat before sufficient damage can be done to create radiological sabotage. At many sites, vital area doors can be reached on foot within similar periods of time as with a vehicle.

The vehicle intrusion at TMI demonstrated that a person in a vehicle could penetrate a protected area barrier and quickly approach a vital area barrier. However, for the public health and safety to be actually affected (absent a real vehicle bomb threat, which will be discussed with respect to the World Trade Center event), the following would also have to be true. The person or persons in the vehicle would have to possess the intent, knowledge of the plant, ' skills, and equipment necessary to create radiological sabotage. They would have to leave the vehicle ano reach one or more vital area barriers. They would have to penetrate the vital area barriers, which are typically reinforced concrete walls and locked and alarmed steel doors. They would have to create a significant loss-of-coolant accident or create a reactor transient. They would have to disable sufficient safety systems to prevent the reactor from reaching a safe condition. They would have to cause a breach of containment. And they would have to accomplish all of this without intervention by the licensee's armed responding security officers. Therefore, staff has concluded that.the TMI event has not demonstratri a need to redefine adequate protection.

In denying a 1991 petition for rulemaking to upgrade the DBT for radiological sabotage to include protection against a vehicle bomb, one factor identified by the staff was that a terrorist-group would have to construct a large truck bomb undetected. The World Trade Center event demonstrated that this can happen.

liowever, to conclude that protection of the public health and safety is not adequate, the NRC would have to conclude that the use of a vehicle bomb to creats radiological sabotage is reasonably to be expected _and that there would not be sufficient time to implement contingency procedures for protecting against a vehicle bomb.

Based on its analysis of the threat environment, staff has concluded that the use of a vehicle bomb to create radiological sabotage at a nuclear power plant is not currently a reasonable expectation.

If a significant change in the general threat environment-caused staff to change this conclusion in the future, current contingency planning, which is designed to_be implemented in a timely manner, would provide staff with a rapid regulatory mechanism to require licensees to implement temporary protection measures and maintain an adequate level of protection while its regulations are amended to require permanent protection.

Therefore, the staff concludes that the World Trade Center event has not established a need to redefine adequate protection.

i l

j

.. I

f -

g' The' Commissioners 5

The staff assessment as to whether to amend its regulations to protect against malevolent use of a vehicle bomb against a nuclear power plant so as to provide a substantial increase in overall protection of the public health and safety is as follows:

Staff has identified several lessons learned from the vehicle intrusion at THI. Although the intrusion detection system generated an alarm, the alarm station operators were not able to confirm the intrusion promptly by CCTV. A foot patrol was sent to evaluate the cause of the alarm.- There was confusion and misinformation given to operations and_ security staff until a positive assessment of the: intrusion could be made. Out of the confusion and concern for personal safety, operations staff made decisions that could have negatively affected the public health and safety.

Even when an initial assessment was made, licensee staff did not know how many unauthorized individuals were inside the protected area, where they were, and whether they possessed weapons or explosives.

The TMI event demonstrates some aspects regarding use of a vehicle by a potential adversary that could present some challenges not previously considered. Therefore, staff considers that providing vehicular intrusion protection would provide a significant-enhancement against such a threat.

Enhancements to protect against the vehicular intrusion threat also provide, to varying degrees dependent on site characteristics (discussed later and in the enclosed regulatory analysis), enhancement for protection against vehicle bombs.

The World Trade Center event has demonstrated a capability within the U.S. to construct a truck bomb undetected. This recently demonstrated capability indicates that although a vehicle bomb attack at a nuclear power plant is not reasonably to be expected, it is somewhat more likely to develop without advance indications than staff previously believed. Staff therefore considers that providing permanently installed vehicle bomb protection would provide significant enhancement against such a-threat.

Staff considers that protecting against vehicle intrusion and a vehicle bomb would substantially increase protection of the public health and safety. A rulemaking package will need to clearly elaborate that this change would be a regulatory enhancement and not redefinition of adequate protection of the health and safety of the public.

In the past', the DBT has been closely associated with adequate protection, although a previous change to the DBT was completed through normal rulemaking and earlier Commission action regarding vehicle threats was-accomplished with a Generic Letter and not considered a matter of adequacy.

k

The Commissioners 6

Public Meetino A public meeting on the NRC DBT for radiological sabotage was held on May 10, 1993.

Formal presentations were made by the NRC and representatives of the Committee to Bridge the Gap, the_ Nuclear Control Institute, NUMARC, and a private citizen from the Harrisburg, Pennsylvania area. Also, all attendees were provided with an opportunity to express their views during a panel discussion.

Briefly, a range of opinions were put forth regarding the need-for vehicle bomb protection at nuclear power plants, and equally diverse views were expressed regarding other aspects of the DBT for radiological sabotage.

In response to a commission request, staff solicited estimates regarding the cost of the various vehicle protection options, but industry representatives at the meeting had no specific input at that time. Additional and more complete details of the meeting are provided in Enclosure 5.

i Reaulatory Analysis provides a regulatory analysis of options related to regulatory changes to address protection against malevolent use of vehicles at nuclear power plants.

(Enclosure 7 provides the Safeguards Information portion of the regulatory analysis.) The four options presented in SECY-93-102 were evaluated along with one additional-option. Option I was to take no action.

Option 2 would require vehicular intrusion protection'at existing protected area vehicle access points and some distance on each side of those access points. Option 3 would require vehicular intrusion protection around.the entire protected area perimeter. Option 4 would require protection against vehicular intrusion and consideration that the vehicle could be transporting an explosive charge.

In general the analysis shows that Option 2 provided little incremental benefit in protecting against either a vehicle intrusion event or a vehicle bomb. The analysis shows that Option 3, in addition to providing vehicular intrusion protection at the protected area boundary, provides varying degrees of protection against a vehicle bomb. At about 80 to 90 percent of the sites, considering distances between protected area boundaries and vital area structures, Option 3 would provide significant protection against a vehicle bomb of the type specified in Enclosure 8.

Option 4 would require all licensees to conduct an analysis of explosive blast effects.

Staff estimates that for many licensees (80 to 90 percent of the sites) the site specific analysis would demonstrate that no additional measures were needed beyond vehicle intrusion protection at the protected area boundary.

Many of the.

remaining sites would need to implement relatively minor enhancements (e.g., inore substantial vehicle barriers to reduce vehicle penetration). A few sites would be required to-implement substantial additional measures (e.g., expansion of vehicle barriers beyond the protected area boundary or placement of blast shields).

Staff analysis shows that, for these few sites, the costs for implementation;of additional measures to meet criteria for protection against a vehicle bomb may be substantial and not commensurate with

. the incremental safety benefit. The regulatory analysis includes cost estimates and factors effecting these estimates for the four options.

The Commissioners 7

Option 5 Based on the analysis of the four options, staff concluded that a fifth option should be proposed.

(This paper only addresses in detail Option 5 because the other four options were previously discussed in SECY-93-102.) This new Option 5 incorporates the protection measures of Option 3 - hardened protected area perimeter against intrusion. However, for Option 5, staff would develop criteria that could be used by licensees to determine, through simplified site-specific analyses, thht protecting against vehicle intrusion into the protected area would also provide high assurance of protection against a vehicle bomb with characteristics of the type specified in Enclosure 8.

These criteria wo'uld specify safe stand-off distances for various types of building constructions typical of those at power reactors. All licensees would be required to review their sites against these criteria, and those sites meeting certification process would demonstrate that about 80 t,timates that this these criteria would certify this to the NRC.

Staff es o 90 percent of the sites could meet these criteria without further analysis or consideration of_

additional measures.

Sites not meeting these criteria would have choices that would include using more substantial (and expensive) barriers for a portion of their protected area to reduce vehicle penetration, extending vehicle barriers beyond the protected area perimeter, performing a more detailed analysis of existing structures and equipment to demonstrate their ability to protect against a vehicle bomb using barriers at the protected area, or evaluating other alternatives. Some licensees may be able to demonstrate that atypical building structures would provide adequate protection, that building damage would not disable vital equipment, or, if vital equipment were damaged, that redundant or diverse equipment could provide a backup function.

If this capability could not be demonstrated, a licensee may have to establish additional security measures to assure protection from a vehicle explosive for vital equipment.

Examples of these measures are extending the hardened barrier outward from the current protected area boundary, placement of blast shielding, or providing backup systems for those assumed to be damaged.

For most sites (80 to 90 percent), the costs for Option 5 would be about

$50,000 more than Option 3.

This amount assumes a confirmation analysis that vital area structures meet staff specified criteria for safe stand-off distances. Many of the remaining sites would have choices available to provide equivalent protection with additional cost.

For the few sites where analysis indicated that stand-off distances may be less than those specified in staff guidance, Option 5 permits evaluation of alternative approaches.

In those cases where licensees determine additional security measures may be needed to protect safe shutdown capability, Option 5 would permit licensees to either implement the additional security measures or develop alternate protection strategies. Staff would review licensee's alternative proposals and make an acceptability determination.

The staff will accept the proposed alternative measures if they provide substantial protection against a land

1 The Commissioners 8

vehicle bomb and the costs of fully meeting the design goals and criteria are disproportionate with the added protection which would be provided.

The Commission would be notified of such staff action.

The Regulatory Analysis (Enclosure 6) contains the essential elements of the appropriate Backfit Analysis for this option, and a suitable Backfit Analysis will be included in the proposed rulemaking package. ' Staff has concluded that Option 5 would significantly increase protection of the public health and safety. Staff has also determined that the direct and indirect costs of implementation of Option 5 are justified in view of the-increased protection.

Staff also notes that the determination on costs of implementation of Option.5 is based on the premise that the only definitive requirement for all licensees is that they provide measures to protect against the use of a land vehicle as a means of transportation to gain rapid access to vital areas and that.they 1

assess any incremental measures, if necessary, to meet the design goal for. a land vehicle bomb. A determination of whether incremental costs were disproportionate to incremental benefit would be made on a site-specific basis.

Coordination with the Department of Enerav (DOE)

The DOE has been advised that the NRC is considering a modification to the NRC-DBT for radiological sabotage. The DOE will be informed in a timely manner of subsequent actions directed by the Commission. Staff will work closely with the DOE to assure that steps taken by the NRC are coordinated with the DOE.

Rulemakina Rulemaking options with regard to the vehicle threat would apply to implementation of a Commission decision to modify the DBT for radiological sabotage and to promulgate related amendments to 10 CFR 73.55. As noted previously, staff has concluded that' the vehicle threat does not present an immediate threat to nuclear power reactors and that additional prudent measures, based on a redefined DBT, will provide, at relatively low cost,. an additional margin of prudence.

While normal rulemaking is an option, staff has focused its consideration on the two more expeditious methods of rulemaking.

Immediately Effective Rule: Promulgate an immediately effective final rule, allowing for public comment only on the final rule and require immediate implementation of licensee vehicle bomb contingency plans until permanent.

measures are in place.

Pros: The most time saving course of action to achieve prompt and enforceable licensee response and to provide protection against the DBV threat.

The Commissioners 9

-Cons: Cannot be supported by a credible justificatioi.,f the reality and immediateness of the threat to negate the need for two Administrative Procedures Act requirements; publication of a proposed rule _with opportunity for public comment, and the 30-day prenotice of effective date.

Presents a litigative risk due to eliminating prior public comment.

May present additional litigative risks to the extent that applicable Commission rules are not applied to enable a timely implementation, e.g.,10 CFR Part 51 (environmental review).

Expedited Rulemakina:

Promulgate a final rule-in an expedited manner.

Pros: May significantly shorten the time between Commission decision and implementation.

Eliminates litigative risk due to eliminating prior public comment.

Cons:

Provides a shortened public comment period.

Resource intensive.

I An additional point should be noted regarding rulemaking in general as applied to the DBT and 10 CFR 73.55. There is no categorical exclusion under Part 51 for this activity, and therefore, an environmental assessment is required.

In addition, both the proposed and the final rules would have to be reviewed by the Committee to Review Generic Requirements and the Advisory Committee on Reactor Safeguards.

An expedited rule for Option 5 would require prompt implementation _of security measures at most sites, given the availability of necessary materials.and hardware. However, for sites where the vehicle control measures to protect against rapid access to vital areas do not meet the commission's criteria for protection against a vehicle bomb, due allowance will be given for time to complete additional analysis, develop alternative' security measures, 'and resolve site specific considerations.

R1 COMMENDATION:

That the Commission approve Option 5:

1) a modification to the DBT for radiological sabotage (10 CFR-73.1) to include the use of a vehicle for the transport of personnel, hand-carried equipment,. and/or explosives (Enclosure.3), 2) appropriate ' modifications to 10 CFR 73.55 to reflect the change to the DBT and to allow for consideration of reasonable alternative security measures when the existing protected area barrier does not provide adequate stand-off distance (Enclosure 4), and 3) an expedited rulemaking to achieve this change. A DBV threat is described in Enclosure 8, including vehicle weight, speed, and explosive payload.

Enclosures 7 and 8 contain Safeguards Information and are therefore being forwarded under separate cover.

The Commissioners 10 COORDINATION:

The Office of the General Counsel has reviewed this paper and has no legal objection.

/_

'. T

.a es r

xecutive rector for Operations

Enclosures:

1. Additional Info Requested by the Commission

2. May 27, 1993 Letter from NUMARC

3. Proposed change to the DBT for radiological sabotage.

4. Proposed change to 10 CFR 73.55

5. Summary of Public Meeting Results

6. Regulatory Analysis

7. Table ~ for Regulatory _ Analysis (Safeguards Information -

provided under separate cover)

8. DBV (Safeguards Information -

provided under separate cover)

Commissioners' comments or consent should be provided directly-to the Office of the Secretary by COB Tuesday, June 29, 1993.

]

Commission Staff Office comments, if any, should be submitted to the Commissioners NLT Tuesday, June 22, 1993, with an infor.

mation copy to the Office of the Secretary.

If the paper is of

~

such a nature that it requires additional. review and comment, the Commissioners and the Secretariat should be apprised of when comments may be expected.

DISTRIBUTION:

Commissioners j

OGC OCAA

.OIG OPP REGIONAL OFFICES

-EDO ACRS SECY ~

ADDITIONAL INFORMATION REQUESTED BY COMMISSION In the May 5, 1993 Staff _ Requirements Memorandum, the Commission requested information on the following:

Continaency Plannina Reauirements for Non-Power Reactors Information related to this topic is being provided to the Commission by separate correspondence.

Industry Estimates on Various Options-At the public meeting on the Design Basis Threat none of the parties took exception to the general range of costs of the options presented in SECY-93-102.

Industry representatives at the meeting had no comment at.that time.

Staff requested Nuclear Management and Resources Council (NUMARC) to provide industry's estimate of. costs to implement the.various options. - NUMARC's May 27, 1993 letter to the NRC responded to this request.

NUMARC's letter is provided as Enclosure 2 to this paper.

Cost of Security at a Nuclear Power Plant Site Information developed by NUMARC on 1991 operations and maintenance (0&M) costs in the nuclear industry showed that security activities account for about 4 percent of total 0&M costs. The per-unit average security cost in 1991 was L 8 million dollars. _ NUMARC also compared O&M costs on a per unit basis be: ween the top and bottom quartiles using a three year average (1989-1991).

For security, on average the top quartile spent 2.68 million dollars (per unit) while the bottom quartile spent 4.15 million.

In NUMARC May 27, 1993 letter to the NRC (Enclosure 2) they provided information calendar year 1993 nuclear plant security costs.

Current Status of Industry Initiatives A large number of licensees have taken actions to provide protective measures against vehicle threats.

Staff is aware that at least 30 reactor sites have implemented permanent measures to restrict vehicle access.

Several techniques have been employed, including measures implemented at the site protected area (PA) perimeter and measures taken along facility primary and secondary access roads. Measures taken at the PA perimeter include aircraft cable woven into the PA fence, heavy concrete barriers placed along portions of the perimeter, buried utility poles / steel beams (bollards) vehicle guard rails, mounding of dirt / sand / gravel, or combinations of these measures. Several licensees have taken measures at PA vehicle access points including some of'the measures described above, hardened gates and parked vehicles to block the gate when not in use. A number of licensees have restricted access to secondary roads by

2-blocking them with large vehicles or heavy concrete barriers. Along primary roads, some utilities have established vehicle check points bounded by substantial barriers such as landscape boulders which would preclude. vehicles from bypassing the check point.

These measures would facilitate licensee's implementation of contingency plans should the need arise. -It should be noted that many of the measures described above would not be sufficient by themselves to provide the protection proposed in Options 3 and 4 of the Commission Paper.

t L

2

y

'4

WT2, a

NUCLEAR MANAGEMENT AND RESOURCES COUNCIL-1776 Eye Street. N.W.. SuiEe 300. Washington. DC 20006-3706 (202)872-1280 May 27,1993 Mr. Frank J. Congel Director Division of Radiation Safety and Safeguards Office of Nuclear Reactor Regulation 11555 Rockville Pike Rockville,MD 20852

Dear Mr. Congel:

This letter responds to your request of May 9,1993, for industry cost estimates to implement vehicle protection options at nuclear power plants (SECY-93-102) and for utility costs for security at these plants.

The NUMARC Security Working Group has begun a review of the need for vehicle protection requirements at plant sites and will develop recommendations for industry consideration. We recommend that the NRC delay action on proposing new vehicle protection requirements until that time.

In the 2-1/2 weeks we have had to prepare a response to your request, there was not sufficient time to perform engineering analyses and cost estimates at the plant sites.

We have been able to gather data indicating the anticipated range ofimplementation costs. These estimates assume the purchase and installation of materials typical of o

highway construction, but the effect oflocal soil conditions has not been included. If performance testing and quality assurance requirements typical of nuclear safety related equipment installation are required, these estimates should be increased by a factor of 3 to 10. Further, no estimates has been made of the costs for long term maintenance of.-

equipment exposed to weather. The NUMARC Security Working Group ha's established an advisory committee to pursue these questions in more detail. This group consists of individuals responsible for or familiar with plant operations, plant security, security facilities engineering, and emergency preparedness.

4

Mr. Frank J. Congel May 27,1993 Page 2 Option 1 -No changes required.

Option 2 A small number of sites have installed " hardened" vehicle gates. A number of different designs are available in the marketplace. We understand that limited testing of some gates has been performed and documented, but we do not yet have specific infonnation in hand. We also do not yet know what installation specifications must be followed to obtain a high level of confidence that a gate will stop a vehicle of a particular~

size.

The number of vehicle gates in protected area (PA) fences at the 69 sites ranges from 2 to 16. The average is 5 gates. Estimates of gate purchase and installation range -

from $10,000 to $60,000. Using the upper end of this range, the cost to implement Option 2 would be approximately $300,000 per site. These figures do not include an allowance to harden the fence for "some distance on either side of the vehicle control points."

Ontion 3 Option 3 involves hardening the gates (Option 2) and installing various barrier devices in front of, in or behind the segments of the PA fence not already protected by natural terrain features. Possible vehicle protection devices for the PA boundary include installation of highway-style guard rails, concrete deflectors (Jersey baniers), aircraft arresting cable, bollards, concrete blocks, and concrete flower pots. Again, some performance data exist which cover a range of vehicle kinetic energies, but this information has not been analyzed.

The " vulnerable" portion of PA perimeter ranges from 1200 ft. to 11,000 ft. The average is 2,600 ft. Cost estimates range from $20 to $120 per foot of protected area perimeter. Assuming that installations at $120 per foot and gate installation costs of

$300,000 per site will provide the protection sought by Option 3, the cost to implement Option 3 is approximately $612,000 per site.

Option 4 We are not now able to provide information on this option. All of the discussion for* option 3 above applies here as well. The design basis explosive (DBE) must first be established. In general, costs will be higher for a given DBE since the perimeter of the standoff area is greater than the perimeter of the protected area. Then, site specific t

-i.-

_ Mr. Frank J. Congel-May 27,1993 Page 3 1

1 analyses would have to be conducted to establish an explosive protection strategy for that site. Not all systems and equipment normally used to achieve safe shutdown are required. Engineering analyses would indicate which components, especially those not currently contained within or shielded by reinforced concrete, could be damaged by the -

DBE without loss of safe shutdown capability.

At some sites the use of natural features would permit lower barrier installation costs because the natural features - swamp, woods, body of water, etc.-would provide a barrier to a land-based vehicle. On the other hand, moving the vehicle control point (s) out beyond the protected area fence could involve:

1.

Relocation of parking lots, 2.

Relocation ofwarehouses, 3.

R.ealignment of site roads, 4.

Vehicle searches at site entrance, as opposed to protected area entrance, 5.

Interference with the response of off-site emergency equipment, e.g., fire trucks, and 6.

Purchase of additional property For example, at one site use of the nominal safe standoff distance would reach across a state highway.

All of this is a function of the design basis explosive (DBE) and the results of each site's analysis of the plant's ability to achieve safe shutdown after loss of equipment which could reasonably be expected to be disabled by the DBE exploding at the protected area fence.

Nuclear Plant Security Costs Based on information from an industry survey, capital cost expenditures for -

security for the 5 year period from 1988 through 1992, inclusive, average $8.2 million per site. The average cost per site for security operations and maintenance was $5.5 million in calendar year 1992.

L.

Mr. Frank J. Congel May 27,1993 Page 4

\\

Based on discussions with individuals in the industry, the major new costs in recent years have been to continually upgrade hardware (a capital expenditure) with the latest technology. Furthermore, some costs associated with security enhancements are accounted for in other categories such as maintenance.

Summary These cost estimates are based on a number of assumptions and are subject to the several qualifications described above. These figures should be viewed as a "first cut" at estimating the costs requested in the Commission's Staff Requirements Memorandum of May 5,1993.

Vehicle Protection Option Averace Cost Per Site 1

No change 2

$300,000+*

3

$612,000 4

Unknown Estimate does not include cost of hardening the fence on each side of the gate.

Conclusion Additional work would be required to develop high confidence cost estimates for these 3 options. Site specific engineering analyses.can proceed only after decisions are made about the size of the explosive. Establishing vehicle denial at a safe standoff perimeter (Generic Letter 89-07) may result in major disruption of routine site activities, interference with the response of off-site fire equipment, land acquisition requirements and other significant impacts.

E Mr. Frank J. Congel May 27,1993

.Page5

.l

-.j As we acquire additional data on the cost of these options, we will provide it. If you have any questions, please call Rich Enkeboll or me.-

Sincerely,.

Robert N. Whitesel

. Manager Operations, Management and Support Services Division ^

RNW:Idl 1

l_j, i

t F

6 n

t I

l

1 l

Proposed Chances to Desion Basis Threat for Radiolooical Sabotace 73.1 Purpose and scope 7

(a)

Purpose ***

(1) Radiological sabotage ***

(i) (E) four-wheel drive land vehicle used for the transport of personnel, hand-carried eouioment. and/or exolosives f

i b

i i

DRAFT RULE LANGUAGE FOR VEHICLE PROTECTION Add new paragraphs (7) and (8) to 10 CFR 73.55(c):

(7) Vehicle control measures shall be established to protect against the use of a land vehicle,_ as specified by the Commission, as a means of transportation to gain rapid access ~ to vital areas.

(8)

Each licensee shall compare the vehicle control measures established in accordance with 10 CFR 73.55(c)(7) with the design goals and criteria for protection against a land vehicle bomb specified by.the Commission.

Each.

licensee shall either (i) certify to the Commission that the vehicle control measures meet the criteria specified, or (ii) propose alternative measures in addition to the measures established in accordance with 10 CFR 73.55(c)(7),

describe the level of protection that these measures would provide against a land vehicle bomb, compare the costs of the alternative measures with the costs of measures necessary to fully meet the criteria.

The' Commission will accept the proposed alternative measures if they provide substantial protection against a land vehicle bomb, and the costs of' fully meeting the.

design goals and criteria are disproportionate to the added protection which would be provided.

l I

1 l

d

SUMMARY

OF PUBLIC COMMENTS ON THE DE0IGN BASIS THREAT FOR RADIOLOGICAL SABOTAGE The Commission directed that staff solicit public comment relevant to the Nuclear Regulatory Commission's review of the Design Basis Threat (DBT) for Radiological Sabotage.

Accordingly, an agency-sponsored public meeting was held to-obtain information from the public, licensees, and other interested parties relevant to the need for any changes to the 1

DBT for radiological sabotage.

The meeting was announced to the public on April 20, 1993, by NRC press release.No. 93-47 and on April 22, 1993, by Federal Reaister Notice 58 FR 21546.

The Federal Reaister Notice also included a request for written comments from interested parties for those that could not attend the meeting.

In addition to these public announcements, eight different public interest groups were invited to make general presentations and to participate in a forum that would address specific aspects of the DBT.

Letters were also sent to facility and corporate security staffs announcing this meeting.

The meeting was held on May 10, 1993, at the Holiday Inn Crowne Plaza in Rockville, Maryland.

Approximately 150 people were'in attendance, which included representatives from the utilities, public interest groups, non-government organizations, and other interested parties.

Respondents to NRC's request for presenta-tions were comprised of representatives from Committee to Bridge the Gap, Nuclear Control Institute (NCI), Nuclear Management and Resources Council (NUMARC), and one private citizen who lives near Three Mile Island.

The' meeting agenda consisted of three sessions--all open to public participation.

The first session involved-separate presentations by the NRC and representatives from Committee to Bridge the Gap, NCI, NUMARC, and one private citizen from the Harrisburg, Pa., area regarding their-individual views on the-DBT.

.The second session involved a forum in.which representa-tives from the three previously mentioned groups, and the general audience, responded to questions regarding various aspects of the DBT.

The third session was to give the audience an-opportunity to discuss any aspect of the DBT; however, due to the paucity of comments from the audience, it was combined with the second-session.

1The term design basis threat (DBT) in this enclosure refers to radiological sabotage only.

2 Specific topics that the NRC presented for discussion during the.

forum included:

(1) size of adversary,_its capabilities (including weaponry) and attributes; (2) use of various transport modes (e.g.,

land, water,_ air) to gain access to the protected and vital areas; (3) use of a vehicle as a weapon or bomb to commit radiological sabotage; (4) attributes of a vehicular threat (e.g., size, speed); (5) quantity of explosives; and (6) use of vehicular-mounted weapons.

The following is a general summary of information received at this meeting and through written correspondence to the NRC.

The NRC. staff does not necessarily endorse the veracity of this data.

Summary of Comments

.The responses to changes in the DBT primarily focused on two distinct issues:

(1) the vulnerability of NRC-licensed commercial nuclear power plants to a forcible vehicular intrusion-involving explosives and (2) the type of_information used by the-NRC to determine the DBT (e.g., trends in terrorism).

Commentors from both the public interest groups and the nuclear industry agreed that a fresh look is needed at the DBT.

There was disagreement on the implications of the Three Mile Island (TMI) intrusion and the World Trade Center explosion, and what relevance these two incidents have to the DBT.

Representatives from the two public interest groups--Committee to Bridge the Gap and NCI--commented at the meeting that the current DBT, which is the Commission's criteria for establishing security regulations, is not adequate.. They stated that the United States is no longer immune to international terrorism's vehicle bomb, as evidenced by the New York Trade Center bombing.

Their recommended DBT changes include, among other things, protection against vehicle bombs.

These representatives further stated that the NRC should consider, when revising the DBT, both trends and realistic hypothetical threats.

Relying on terrorism trends to guide the DBT standard fails to identify or foresee precursors, incipient trends, and one-of-a-kind events.

The public' interest groups advocated, as they had in their previous petition on the subject,_ extending the Individual Plant-Examination for External Events program to. require licensees to perform plant-specific-analyses'of their vulnerabilities to vehicle bombs.

Conversely, representatives from the nuclear-industry stated that current nuclear power plants' security arrangements provide more than adequate public health and safety protection.

The new DBT

1 3

assessment should only include information from the World Trade Center and TMI incidents that are relevant to'the threat to nuclear power plants.

-Industry challenged the assumption that a. credible threat of radiological sabotage to nuclear power plants exists in this country and contended that the DBT should not be assumed to be a paramilitary force.

(Reference was made to a downward trend in domestic terrorist events over the last several years.)

Moreover, the DBT review should also include plant experierce'and trends in domestic terrorist events over the last 16 years.

Industry further stated that the profiles and motivations of existing terrorist groups, and the tactics these groups would use, should be factored in when considering any DBT changes.

Industry stated that terrorists choose targets that have maximum chance of success and minimum risk to themselves.

To approach a facility that has security in place has far more risk attached to it than an unsecured high profile target such as the World Trade Center.

Industry (NUMARC) recommended.that NRC delay proposing any vehicle-protection requirements until an industry security working group completes their own review of the need for these requirements at plant sites and develops' recommendations for industry consideration.

A range of cost estimates for implementing certain facility vehicle barriers was also provided to the NRC (Enclosure 2).

Specific Aspects of the DBT The following are comments from public interest groups and the general public (referred to as "public commentors") and the nuclear industry on specific aspects of the DBT.

Included in the public commentors' responses are comments from several. facility security officero who were responding on their own behalf.

Adversary size:

Public commentors stated ~that the DBT should require that plants protect against teams of terrorists operating in multiple groups.

In light of the current threat environment, both the number of presumed adversaries in the DBT and the number of facility armed guards are too small to be considered.

realistic._ Although it was mentioned that a single attacker would suffice, as evidenced by the recent TMI incident and espccially when-it comes to a vehicular bomb.

One public commentor said that the adversary size is less:impor' ant than the vehicular bomb.

Industry group stated that the' size of the external adversary should not be. considered before deciding what the nature of the

4 k

actual threat is to_the nuclear power. plants, i.e.,

is it a paramilitary force?

Further, the actual threat should be based on the activities of terrorists in the United States.

Insider threat--activities that an insider can neroetrate:

Public commentors stated that consideration should be given to 1

the potential cooperation between an insider and external adversaries using a vehicle bomb.

Because of this, the insider threat should not be excluded--at least "one insider" should be-considered.

Moreover, if a vehicle bomb adversary manages to secure the cooperation of an insider in certain important-positions (through any means, including misleading-the insider about his or her intentions), the damaging ef fects of a vehicle bomb can be increased.

With respect to the industry's arguments that the insider threat should be eliminated, one public commentor stated that all the trustworthiness measures mentioned

~

could be bypassed by coercion from outside the plant.

Industry representatives stated-that the insider threat should be eliminated because of the access authorization and fitness for duty rules, the continued behavior observation programs, and the plants" emphasis on fostering teamwork.

In addition, industry stated that since the NRC has been keeping records, there is no recorded incidents of radiological sabotage; only one incident-exists of sabotage and that was-classified as industrial.

Capability of an adversary usina more than hand-carried weapons and eauinment:

Public commentors stated that if it is a realistic assumption that a vehicle.will be used by an' attacker

~

or attackers, obviously more weapons and equipment would be used; the adversaries would not be limited to what could be hand-carried.

Since vehicles are readily available to potential adversaries,-the question that should be considered is whether the weapons and equipment are greucer than what is provided for in the current'DBT.

Furthermore, as evidenced by international events, terrorists have used more than' hand-carried weaponry for

'this type of activity.

Terrorists have acquired sizable conven-tional military arsenals, including small rocket launchers and anti-tank ordnance.

Other specific weapons mentioned include rocket-propelled grenades (RPG).

(The DBT's attributes of hand-carried weapons include the use of RPGs.)

Industry stated that assigning adversary capabilities is premature until it is determined that a paramilitary force is indeed a threat to a nuclear power plant.

Adversary use of land-based vehicles for transoort of gersonnel and eauipment, as a weaDon or as a vehicle bomb, and' vehicle tvoe and weicht:

Public commentors responded that the use of a vehicle is significant as demonstrated by the TMI incident.

The

5 i

NRC needs to consider vehicles and protection to prevent them from getting close to the plant.

Specifically, protection against truck and boat-bombs, which the NRC should consider simultaneously, with the airborne threat given further consideration; the NRC should not delay the first issues, while considering the less likely and more difficult airborne threat.

Barriers should be established at an effective stand-off distance.

Public commentors-further stated that the DBT should protect against the type of vehicles that are readily. accessible to the public, in particularly rental agencies; a four-wheel drive vehicle with a large weight-carrying capacity was specifically mentioned.

Consideration should be given for individuals bypassing the normal access roads and attempting to enter the plant off-road.

The only response received regarding speed the vehicle would be travelling, in reference to the DBT, is that putting control barriers would force a vehicle to drive in a zig-zag pattern, thus reducing speed.

Industry comments on the above topics were that the TMI intruder, although successful in crashing a vehicle through the gates, was a trespasser; this event did not represent a radiological sabotage threat to the plant.

Vehicle-mounted weaoons:

The only comment received was from public conmentors who stated that a reasonable assumption could be made that by using a vehicle, vehicle-mounted weapons would also be used.

Location of vehicle barriers:

Public commentorsfstated that by planning for a penetration at vehicle access points, and placing vehicle denial systems at those points only, would allow potential adversaries to bypass those barriers with an off-road vehicle.

Location of vehicle barriers to provide the areatest safety benefit--orotected entrv/ exit vehicle access ooints, around the protected area, or at a determined stand-off distance:

The only comment was from public commentors who stated that protection at a greater distance from the plant'might be easier but at a minimum they should be placed at the stand-off distance.

Size of exolosives:

The only comment received was from public commentors:

the NRC should consider the worst case based on what

~

has actually happened in the past (i.e., Beirut) and that amount ~

is approximately 10,000 pounds.

~6 Costs of implementina orotective measures based on a defined DBT vehicle and a DBT explosive:

Public interest. stated their estimate as a few hundred thousand dollars to a million dollars per site to install and a few tens of thousands:of dollars per year to maintain the type of protective measures previously mentioned.

Industry representatives stated that the installation could cost greater than a million dollars at some sites.

Vendor costs should be cautiously evaluated, especially when-the vendor does not do the installation.

It was also mentioned that facilities have a number of buried electrical cables,-gas lines, water, etc., and to install the barriers with the-stopping powers previously discussed, the system must be firmly anchored, which would involve a number of deep holes.

Industry (NUMARC) also provided an anticipated range of costs for implementing-certain facility vehicle barriers (Enclosure 2).

In some cases, the perimeter fence may have to be redesigned, which would be an additional and costly' expense.

Industry did not. provide any operational cost because of the time involved-in determining the cost on a site-specific basis..

Cost of security to protect acainst a land-based vehicle outweichina the risk to the oublic health and safetv: ~Public commentors stated that keeping the costs in the low millions of dollars is not a major consideration.

They consider this-as a reasonable cost to reduce such a risk to the public health and safety.

Industry representatives stated that in determining costs, the probability of the event, and the consequences expected from it should be balanced with what is being spent to protect against-the threat.

Since there has never been a threat to power plants in this country, expenditures to install systems at power plants that' protect against a terrorist attack are not warranted.~ Based on past trends, there has never been a credible threat from terrorist groups to U.S. power plants.-

Affect of vehicle Drotection systems on normal and emeraency plant operations:

Public commentors stated that physical barriers previously mentioned should not pose any serious problems regarding access to the plant for emergency vehicles.

(Types of barriers mentioned include hydraulically lifted gates and vehicle denial systems along the protected area fences.)

Industry representatives stated that a site-specific analysis is needed to make this determination.

However, with the systems i

j

7 previously mentioned--large vehicles, capable of carrying 10,000 pounds--the necessary hardware would surely have an affect on ingress and egress from the protected area.

Other DBT characteristics that should be chanced, added, or deleted:

Public commentors responded that the use of bullet-proof vests by the adversaries should be considered, and as a result, this may require some adjustment in terms of tactics used by the facility's protective force.

Public utilities that have installed, or olan to install, vehicle protection systems as a result of the World Trade Center and TMI incidents:

Public commentors stated that the cost of installing protective measures against the type of threat which'would change the DBT is a reasonable cost to protect the public health and safety.

A representative from one utility stated that a crash-proof gate and barriers, located at some of that facility's weaker points, were installed as a result of the Beirut incident.

It was mentioned that this was done as a prudent measure by this company and this decision needs to be made separately by each utility.

Utilities that would croceed to install systems to protect acainst a desian basis vehicle and a desian basis explosive before final rulemakina is completed:

Public commentors stated that the NRC should move promptly with an immediately effective rule and not rely upon volunteerism by the utilities.

Industry representatives could not comment on this issue since those attending the meeting were not in a position to make that decision.

Relvina on advance warnina of a terrorist threat acainst U.S.

nower olants before the NRC asks the facilities to protect acainst a vehicle threat:

Public commentors stated that the NRC should not wait for advance warning from the' intelligence-community.before taking prudent measures to protect against such an' event.

Moreover, advance warning is not always certain or likely, and as evidenced by the successful TMI intrusion, where no advance warning was given.

Industry representatives stated that this issue should Dest be answered by the intelligence community and law enforcement officials'at the Federal level who have access to intelligence information.

2-o REGULATORY ANALYSIS Malevolent Use of Vehicles at Nuclear Power Plants 1.0 STATEMENT OF THE ISSUE

1.1 Background

The Commission began its deliberations on the vehicle issue in 1985 and a series of Commission m etings and papers followed. These meetings and papers focused on a range of options to respond to the' potential. threat posed by vehicles, Nuclear Regulatory Commission and other agency assessments of the threat, and the continuing validity of the design basis threat (DBT) for radiological sabotage. Staff provided options to the Commission in SECY-86-101 and SECY-88-127. Options were included for contingency, both short-range and long-range planning by licensees and NRC, and for various physical security requirements. The physical security options addressed were:

1) vehicle denial system on existing access roads to power-reactor sites,

2) vehicle denial system for land portion of protected area (PA) perimeter, and 3) surface vehicle bomb protection.

The Commission also solicited the views of other agencies. A number of Commission meetings between 1985 and 1987 included threat briefings by the Central Intelligence Agency (CIA), the Federal Bureau of Investigation (FBI),

and the Department of Energy.

Further, guidance was sought from the National Security Council (NSC). The NSC and the FBI documented their assessments in classified correspondence to the NRC.

Although staff recommended that the Commission approve centingency plans for use by the NRC staff in the event.that a vehicle bomb threat were to arise, the Commission directed in a Staff Requirements Memorandum (SRM), dated June 16, 1988, that short-range contingency planning by licensees be required that would assure that plans were in place for installation of temporary emergency measures for response to a surface vehicle bomb. threat.

In choosing short-range contingency planning, the Commission also chose not to modify the DBT based on available information.

Contingency planning for surface-vehicle bombs was addressed in Generic Letter 89-07 and developed by licensees in 1989.

1.2 Recent Events The intrusion incident at the Three Mile Island (TMI) power reactor and the bombing at the World Trade Center renewed concerns about the vehicle threat.

Regarding the intrusion at THI, NUREG-1485, " Unauthorized Forced Entry into the PA at Three Mile Island Unit 1 on February 7,1993," reports the findings of the NRC Incident Investigation Team. The report highlighted the fact that PA barriers could be penetrated by vehicles and that assessment and response to such a penetration was difficult.

In the World Trade Center attack it appears that a van bomb, containing between 500 and 1,500 pounds of explosives, was detonated in a public underground parking garage. These.two events initiated the need for staff to reassess the DBT with respect to malevolent use of a vehicle.

At an April 22, 1993 Commission meeting on SECY-93-102, staff reviewed past Commission deliberations on the vehicle threat and presented four proposed options with cost estimates in response to the current evaluation. Option 1

4

.o 2

was to take no action. Option 2 would require vehicle protection at existing PA vehicle access points and some distance on each side of those access points. Option 3 would. require vehicle protection around the entire PA perimeter. Option 4 would require protection against some specified design.

basis vehicle (DBV) and explosive charge.

In addition to the proposed options, staff noted that, absent an immediate actual vehicle threat, a staff-recommendation on which of the four proposed options the Commission should adopt would be delayed until after a May 10, 1993, public meeting on the DBT.

This delay would permit staff consideration of public input. Staff also presented updated intelligence information at the closed portion of the April 22, 1993 Commission meeting.

2.0 OBJECTIVES OF THE ANALYSIS Following the recent events, staff was directed by the Commission to expeditiously prepare options for their consideration, without completing all of the normal supporting documentation such as a regulatory analysis. On May 26, 1993, the Executive Director for Operations forwarded a predecisional draft staff paper for Commission information prior to a scheduled Congressional Hearing on May 27. That memorandum noted that staff had not developed the required regulatory analysis to justify the addition of a DBV to the DBT.

It also noted that staff believes that flexibility is needed with respect to implementation to provide DBV protection at some distance from vital equipment at a reasonable cost. The objective of this regulatory analysis is to analyze the four options presented to the Commission in SECY-93-102; develop a fifth option to provide the needed flexibility; and to explain the technical rationale and basis for staff judgments sufficiently to support any proposed rulemaking.

3.0 ORIGINAL OPTIONS 3.1 Option 1 No change in current position.

3.2 Option 2 Roadway protection - Require a vehicular protection system on existing road.

ways and some distance on either side of the vehicle control points into pas.

This option would protect against forced vehicle entry only in the immediate area of existing vehicle gates into the PA.

Because the remainder of the PA -

perimeter would remain vulnerable to vehicle intrusions, licensee contingency planning for land vehicle bombs would be retained.

Barriers that could be used to protect gates include permanent active barriers that can be lowered to permit passage of authorized vehicles and temporary barriers that can be moved. Adjacent areas could be protected by passive barriers such as concrete blocks, bollards (i.e., heavy posts), or planters, all which must be prcperly anchored into the ground.

.e-l 3

3.3 Option 3 PA Perimeter Protection - Instead of existing contingency _ procedures, require protection against vehicular intrusions into pas.

This option would extend vehicle protection to the entire PA.

In addition to-the type of. barriers discussed in-Option 2, licensees could use other techniques such as trenching or reinforcing existing perimeter with; anchored cabling systems.

This option would also provide varying degrees of protection against a vehicle bomb. At facilities with an average sized PA and typical. concrete structures, a vehicle bomb similar to that reportedly used at the World Trade Center may cause moderate damage to some concrete walls. However, the safety equipment located behind typical concrete walls, but not contiguous to outside walls, would likely be protected. Some facilities also have intervening structures which might absorb some of the energy from an explosive blast.

However, some pas are smaller and have portions of the PA perimeter that are close to a vital area barrier and would likely be severely damaged.

In addition, not all safety equipment is protected by reinforced concrete walls.

At a few sites, significant portions of safety systems are not behind concrete walls.

3.4 Option 4 Protection at Standoff Distance for a DBV and Explosive Device - Instead of existing contingency procedures, require protection against a vehicle bomb of a specified size.

Existing vehicle bomb contingency procedures would remain in effect until permanent measures are implemented.

At some sites, protection against vehicular intrusions into pas may be sufficient to protect against the DBV bomb. At other sites, licensees would have to provide additional measures to protect against unauthorized vehicles approaching close enough to vital equipment to cause a significant' safety risk. Staff believes that this could be done at most sites without reconfiguring uisting PA perimeters, intrusion detection systems ~, and closed-circuit television (CCTV) or increasing the size of security forces. The extent of additional measures required for some sites would vary depending on the size of the design basis explosive used in determining appropriate stand-off distances.

Implementation options would include installing permanent or moveable barriers to protect against vehicle access to portions of the PA perimeter or installing blast shields or deflectors to protect' vital equipment.

..A 4

4.0 CONSEQUENCES 4.1 Analytical Approach j

Staff conducted a preliminary analysis of the benefits and costs of the four options in support of SECY-93-102.

Because of the short time available, this preliminary analysis was limited in scope. To assess the benefit from protection against use of a vehicle for forced entry into the PA (absent a bomb threat), staff reviewed NUREG-1485, " Unauthorized Forced Entry into the Protected Area at Three Mile Island Unit 1 on February 7,1993." For the purposes of this analysis, staff also reviewed prior assessments of the vehicle intrusion issue.

It also examined details of the times it would have taken an adversary to reach vital areas from the PA at THI, both using a vehicle and on foot, which was outside the scope of NUREG-1485.

In analyzing the benefits of protecting against a vehicle bomb for SECY-93-102, staff reviewed drawings of all 67 power reactor sites that are currently operating or are in temporary outages, that showed the owner controlled area, the PA, and the location of buildings that contained vital equipment.

For all sites, staff estimated the shortest distance between the outer edge of the owner controlled area and a vital-area.

For 26 sites, chosen at random, staff estimated the length of the PA perimeter, the shortest distance between the PA perimeter and a vital area, and the shortest distance between a parking area and the nearest vital area. Because of the small scales involved, many of the estimates of distances were imprecise.

To estimate the impact of a truck bomb of the size described in Enclosure 8, staff assumed a building with concrete walls 18 inches thick and an effective density of reuar of 0.2 percent. Most vital area barriers equal or exceed-this assumption, although several sites' have a few pieces of vital equipment that are not within structures. Staff assumed that the ceilings or roofs of vital area structures would provide protection at least equivalent to the wall assumption.

For distances at which the closest vital area structure would provide a low level of protection, staff assumed that vital equipment within the structure would be disabled. Staff estimated the impact ~ of an explosive blast on building structures using the United States (U.S.) Corps of Engineers Blast Analysis Manual, PDC-TR-91-6, July 1991.

Staff did not as mss the sig-nificance of the actual equipment in the nearest vital area ' structures 'nor did it assess whether redundant or diverse equipment would continue to function..

Since preparing SECY-93-102, staff has expanded the scope of its analysis of-vehicle bomb protection.

It has expanded its review of site drawings to all 67 sites.

It then identified the 30 sites that its initial analysis indicated had a specified distance between the PA and the nearest vital area.

(At a distance greater than the specif_ied distance, most vital area barriers should provide at least a medium-level of protection. The Corps of Engineers uses medium level of protection to describe a structure that would be damaged, but repairable. Occupants or other assets within the structure may sustain minor injuries or damage.) For these 30 sites, it determined, through information obtained by the resident inspectors, more precise estimates of the distance

i.

.l 5

o from the PA to 'all vital areas that were within 125.

For these vital areas it obtained available details on the wall structures.

For vital area structures that appeared to provide less than medium protection, it assumed that the vital equipment within the structure would be disabled and then determined whether redundant or diverse equipment would be available to perform the same function.

Staff has been unable to obtain data on the direct effect of r explosive blast on unprotected equipment.

Its' initial assessment on eq ment not in buildings focused on the availability of diverse systems, substantial intervening buildings, and stand-off distances sufficient to reduce blast overpressures to the same range as static pressures used in design to protect against natural phenomena.

4.2 Benefits Traditionally, the staff has not attempted a quantitative evaluation of the benefits associated with safeguards requirements.

In 1983 the NRC reviewed past efforts to quantify risk due to sabotage of nuclear power plants in an attempt to include consideration of that risk in the Commission's safety goal.

The review led the staff to conclude that sabotage should not be included in the safety goal because no technical basis was available for quantifying the contribution of sabotage to the overall risk from nuclear power plant operations.

For the purpose of this analysis, a quantitative evaluation would require, among other things, quantification of the likelihood that someone would use a vehicle bomb in an attempt to damage a nuclear power plant, the probability that the bomb would be set off from a stationary location or that forced entry into the PA would be attempted, the probability that a bomb of a particular size would be used, and the probability that the bomb would be in a particular location.

Staff is unable to quantify any of these factors.

In analyzing Options 2 and 3, staff first qualitatively considered the benefits that would be gained from avoiding a THI-type intrusion, assuming that the intruders had malevolent intent and the characteristics of'the DBT specified in 10 CFR 73.1(a). Option 2 would provide little incremental benefit, since portions of the PA perimeter at most sites would still be protected by only a chain link fence. A typical unenhanced chain link fence provides little protection against a moving vehicle.

For.any sites where Option 2 would be effective because natural terrain or other site features prevent access to the PA perimeter away from vehicle access points, the site would effectively meet Option 3 at no additional costs beyond those to meet Option 2.

With respect to Option 3, staff identified several lessons learned from the vehicle intrusion at Tdl. Although the intrusion detection system generated an alarm, the alarm station operators were not able to confirm the intrusion promptly by CCTV. A foot patrol was sent to evaluate the cause of the alarm.

There was confusion and misinformation given to operations and security staff

6 until a positive assessment of the intrusion could be made. Out of the confusion and concern for personal safety, operations staff made decisions that could have negatively affected the public health and safety.

Even when an initial assessment was made, licensee staff did not know how many unauthorized individuals were inside the PA, where they were, and whether they posses:ed weapons or explosives. The vehicle also could have provided some protection from responder weapons fire, could have been used as a breaching device, or could have been used as a weapon against on-site personnel.

Although at many sites, vital area doors can be reached on foot within similar periods of time as with a vehicle, the incident demonstrated that a person in a vehicle could penetrate a PA barrier and quickly approach a vital area barrier. Staff estimates that at TMI an adversary in a vehicle could have reached vital areas about 50 seconds faster than on foot. At some sites, this difference could significantly affect the licensee's ability to interdict an adversary before critical safety equipment was reached.

By providing protection against vehicular intrusion into the PA, Option 3 also provides varying degrees of protection against a vehicle bomb.

If a barrier stopped a vehicle at the PA perimeter with little or no further penetration, about 90 percent of the sites would provide significant protection against a vehicle bomb of the type specified in Enclosure 8.

Barriers that result in no vehicle penetration for vehicle. impacts at specified kinetic energies are typically more expensive than those that allow some penetration.

For less expensive barriers, a vehicle of the type specified in Enclosure 8 may penetrate as'much as 30 feet into the PA.

For these types of barriers, about 80 percent of the sites would provide significant protection.

Staff's analysis also indicates that there is a high likelihood that all sites would be capable of achieving and maintaining safe shutdown if a vehicle bomb of the size specified in Enclosure 8 were detonated at' any lana accessible location of a nuclear power plant outside of the owner controlled area.

Option 4 would provide an additional benefit by assuring that the remaining 10-to 20 percent of the sites wo11d provide significant protection against a vehicle bomb of the type specified in Enclosure 8. to this Commission paper provides isfarmation (Safeguards Information provided under separate cover) regarding potential impact at certain sites that might not provide significant protectun against a large vehicle bomb that was stopped at the PA perimeter.

4.3 Assumptions used in Predicting Backfit Costs General Assumotions 1.

Based on analysis of all power reactor sites, site perimeters range between about 2,000 and 9,000 feet. Site PA perimeters that have potential for land vehicular access range from 2,000 to 7,000 feet. This range assumes some protection by natural terrain features which would preclude the need for protection of portions of the PA.

7 j

2.

Site has four vehicle access points. Some sites may have up to 15 vehicle J

access points to. protect.

Costs of Specific Intrusion Protection Devices Active Vehicle Access Barriers Active barriers - Active vehicle access barriers include reinforced sliding gates and pop-up barriers. Vendor prices for materials and installation of active barriers of these types with a width of 10 - 12 feet range between $15

- 35K.

Price is dependent on several factors, most important of which is the design characteristics (size and speed) of the vehicle to be stopped.

To account for licensee overhead costs (engineering, interface connections, procurement, and training) the vendor costs have been doubled. Therefore, the prices used in the cost estimates are as follows:

a.

$30K for an active barrier to stop a passenger vehicle b.

$40K for an active barrier to stop a pickup truck c.

$70K for an active barrier to stop a large truck Passive Barriers - Commonly used passive barriers are concrete barriers (Jersey Bounces) or cabling that can be placed at the PA fence and anchored at periodic intervals.

Passive barriers to stop larger size vehicles include concrete planters and reinforced concrete walls.

Price is dependent on a number of factors, most important being the size and speed of the vehicle (kinetic energy).

Licensees may also choose combinations of options, such as a means to slow down a vehicle, which would justify less substantial barriers.

Vendor prices for concrete barriers and cabling that can stop passenger size vehicles are estimated to be between $16 and $25 per foot. Vendor prices for passive barriers that can stop pickup trucks are estimated to be between $36 and $60 per foot, although staff did not find specific barrier test data for barriers that stop this size vehicle.

Vendor prices for passive barriers that can stop large trucks are estimated to be between $110 and $136 per foot. To account for licensee overhead costs (engineering and procurement) the vendor costs have been tripled. Therefore, the prices used in the cost estimates are as follows:

a.

$60/ft for a passive barrier to stop a passenger size vehicle with some penetration

$90/ft for a passive br.rrier to stop a passenger size vehicle with no penetration b.

$150/ft for a passive barrier to stop a pickup truck witn some penetration

$225/ft for a passive barrier to stop a pickup truck with no penetration c.

$375/ft for a passive barrier to stop a large truck with some penetration

$550/ft for a passive barrier to stop a large truck with no penetration

8 Standoff Distance Analysis - If required to do a site-specific analysis, it is assumed that a licensee would need to do one similar to that described in NUREG/CR-5246, "A Methodology to Assist in Contingency Planning for Protection of Nuclear Power Plants Against Land Vehicle Bombs." This analysis would consist primarily of two major elements.

1.

Blast Effect Analysis - The blast analysis would require assessment of what vital structures would be damaged and what vital equipment in that structure was damaged (assuming an explosive size). At many sites, where equipment was located inside reinforced concrete walls at-sufficient standoff distances from the PA, this analysis would not need to be extensive. At other sites, with shorter distances between the PA boundary and vital area structures, this analysis could be significantly more complex. Vital equipment needed to be protected and not located in a building would also add to the complexity of the analysis.

2.

Systems Analysis - Once it was determined what equipment was damaged, analysis would need-to be done to determine if there was backup equipment, not damaged, that would allow the plant to maintain a safe shutdowr condition.

4.4 Results of Costs Analysis Option 1 - No change in current position.

Cost Summary:

No additional costs Option 2 - Roadway vehicle intrusion protection at PA perimeter.

Cost Summary:

Items Passenger Pickup Large Vehicle Truck Truck 1.

4 Active Vehicle 120 160 280 Access Barriers 2.

800' Passive 48 120 300 Barrier Total 5168K

$280K 5580K l

9:

Option 3 -. Vehicle intrusion' protection at PA perimeter.

Cost Summary:

Items Passenger Pickup Large Vehicle Truck Truck-1.

4 Active Vehicle 120/120 160/ 160-280/- 280-Access Barriers 2.

2,000/7,000' Passive 120/420 300/1,050-750/2,625 Barrier Total

$240/540K

$460/1,210K

$1,030/2,905K Option 4 - Protection at safe standoff distance for DBV and explosive' device.

Cost Summary Case 1:

(Assumes analysis demonstrates safe standoff distances are within present PA - About 80 percent of sites)

Items Passenger Pickup Large i

Vehicle Truck Truck 1.

4 Active Vehicle 12C/120 160/ 160

'280/ 280 Access Barriers 2.

2,000/7,000' Passive 120/420 300/1,050 750/2,625 Barrier 3.

Standoff Analysis 115/115

.115/ 115 115/ 115 Total

$355/655K

$575/1,325K

$1,145/3,020K Cost Summary Case 2:

(Assumes analysis demonstrates safe standoff distances go beyond PA boundary for about 1/3.of boundary and further. hardening of portions of PA barrier to penetration needed)

Items Passenger Pickup Large Vehicle -

Truck Truck i

1.

4 Active Vehicle 120/120 160/ 160 280/ 280 Access Barriers 2.

2000/7000' Passive 120/420 300/1,050 750/2,625 Barrier 1

1000/2000'; Passive 90/100 225/ 450 550/1,100 Barrier - hardened 3.

Standoff Analysis 300/300 300/ 300 300/ 300 l

1 Total

$630/940K

$985/1,960K

$1,880/4,305K

'l i

i

o

.. ~

10 Discussion of Factors Impactina Cost of Option 41 Ranges in cost estimates for the three vehicle types illustrates the influence of site-specific characteristics on costs, including the need at some sites to extend the vehicle exclusion area beyond portions of the current PA boundary _or providing a more' substantial passive barrier to prevent vehicle penetration.

At a few sites, extension of the vehicle exclusion area beyond the current PA boundary may result in costs that exceed the upper range of the cost estimate.

The need for a licensee to provide additional measures beyond those needed to protect against vehicle penetration into the PA (Option 3) is a factor of the structural details of buildings containing vital equipment and tne distance of the buildings from the PA.

In SECY-93-102, staff indicated that at facilities with an average sized PA and typical concrete structures, a vehicle bomb similar to that reportedly used at the World Trade Center may cause moderate damage to some concrete walls. However, the safety equipment located behind typical concrete walls, but not contiguous to outside walls, would likely be_ protected.

5.0 DECISION RATIONALE The staff continually monitors and evaluates the threat environment worldwide.

In addition, the Commission was briefed by the CIA and the FBI on March 5, 1993.

Neither agency provided information regarding an actual vehicle threat to domestic commercial nuclear power reactors that could serve as the basis for modifying the DBT.

Further, staff reported on its analysis of more than 500 vehicle bomb attacks worldwide. Although, based on current information,-

there is no significant change in the threat environment, the bombing at the World Trade Center demonstrated that a large explosive device could be assembled, delivered to a public area, and detonated in the U.S. without advanced intelligence knowledge.

In addition, the unauthorized intrusion at TMI demonstrated that a vehicle could be used to gain quick access'to Pk of the plant.

Consequently, the staff has concluded that a modification' to the DBT is warranted.

The DBT is not intended to represent a real threat.

It serves three purposes.

It provides a standard with which to measure changes in the real threat environment.

It is used to develop regulatory requirements.

And it provides a standard for evaluation of implemented safeguards systems.

In assessing the impact on the DBT of the events at TMI and the World Trade.

Center, staff has considered the following two' issues:

first, whether these events establish the need for NRC to revise its regulations' to redefine-adequate protection of the health and safety of the public,.in the sense that adequate protection is used by section 182 of the Atomic Energy Act; and second, whether these events demonstrate that amending NRC's regulations to protect against malevolent use of a vehicle at nuclear power plants 'would result in a substantial increase'in the overall protection of the public

'l

)

9

...s.

11 health and safety. With respect to the first issue, the NRC cannot consider cost. With respect to the second issue, the NRC must determine that the direct and indirect costs of implementation are justified in view of. the increased protection.

The staff's assessment as to whether to redefine adequate protection is as follows:

The vehicle intrusion at TMI demonstrated that a person in a vehicle could penetrate a PA barrier and quickly approach a vital area barrier. However, for the public health and safety to be actually affected (absent a vehicle bomb threat, which will be discussed with respect to World Trade Center event), the following would also have to be true. The person or persons in the vehicle would have to possess the intent, knowledge of the plant skills, and equipment necessary to create radiological sabotage.

They would have to leave the vehicle and reach one or more vital areas barriers. They would have to penetrate the vital area barriers, which are typically reinforced concrete walls and locked and alarmed steel doors. They would have to create a significant loss-of-coolant accident or create a reactor transient.

They would have to disable sufficient safety systems to prevent the reactor from reaching a safe condition. They would have to cause a breach of containment. And they would have to ' accomplish all of this without intervention by the licensee's armed responding security officers.

The NRC interpretation of the DBT for radiological sabotage does-not preclude adversaries' use of vehicles, other than vehicle bombs, for transportation and for breaching PA barriers. The vehicle should be detected by an intrusion detection system as it enters the PA. The nature of the threat should be assessed using.

CCTV or other means.

Responding security officers should be able to neutralize the threat before sufficient damage can be done to create radiological sabotage. At many sites, vital a'rea doors can be reached on foot within similar periods of time as with a vehicle.

Therefore, staff has concluded that the THI event has not demonstrated a need to redefine adequate protection.

In denying a 1991 petition for rulemaking to upgrade the DBT for radiological sabotage to include protection against a vehicle bomb, one factor identified by the staff was that a terrorist group would have to construct a large truck bomb undetected.

The World Trade Center event demonstrated-that this can happen.

However, to conclude that protection of the public health and safety is not adequate, the NRC would have to' conclude that the.

use of a. vehicle bomb to create radiological sabotage is reason-ably to be expected and that there would not be sufficient time to implement contingency procedures for protecting against a vehicle-bomb.

Based on its analysis of the current threat environment,

12 staff has concluded that the use of a vehicle bomb to create radiological sabotage at a nuclear power plant is not currently a reasonable expectation.

If a significant change in the general threat environment caused staff to change this conclusion in the future, current contingency planning, which is designed to be implemented in 'a timely manner, would provide staff with a rapid regulatory mechanism to implement temporary protection measures and maintain an adequate level of protection while its regulations are amended to require permanent protection. Therefore, the staff concludes that the World Trade Center event has not established a need to redefine adequate protection.

The staff assessment as to whether to amend its regulations to protect against malevolent use of a vehicle bomb against a nuclear power plant so as' to provide a substantial increase in overall protection of the public health and safety is as follows:

Staff has identified several lessons learned from the vehicle intrusion at TMI. Although the intrusion detection system generated an alarm, the alarm station operators were not able to confirm the intrusion promptly by CCTV. A foot patrol was sent to evaluate the cause of the alarm. There was confusion and misinformation given to operations and security staff until a positive assessment of the intrusion could be made. Out of the confusion and concern for personal safety, operations staff.made decisions that could have negatively affected the public health and safety.

Even when an initial assessment was t.de, licensee staff did not know how many unauthorized individuals were inside the PA, where they were, and whether they possessed weapons or explosives.

The TMI event demonstrates some aspects regarding use of a vehicle by a potential adversary that could provide advantages not previously considered. Therefore, staff considers that providing vehicular intrusion protection would provide a significant enhancement against such a threat. Enhancements to protect against the vehicular intrusion threat also provide, to varying degrees dependent on site -

characteristics, enhancement for protection against vehicle bombs.

The World Trade Center event has demonstrated a' capability within the U.S. to construct a truck bomb undetected.

This recently demonstrated capability indicates that although a vehicle bomb attack at a nuclear power plant is not reasonably to be expected, it is somewhat more likely to develop without advance indications than staff previously believed.

Staff therefore considers that providing vehicle bomb protection would provide significant enhancement against such a threat.

Based on the analysis of the four options discussed in Sections.4 and 5, staff 3

concluded that a fifth option should be proposed that would offer a more realistic and practical approach.

l 1

. ::s 13 6.0 OPTION 5 This new Option 5 incorporates the protection measures of Option 3 - hardened protected area perimeter against intrusion.

However, for Option 5, staff would develop criteria that could be used by licensees to determine,'through simplified site-specific analyses, that protecting against vehicle intrusion into the protected area would also provide high assurance of protection against a vehicle bomb with characteristics of the type specified in. Enclosure 8.

These criteria would specify safe stand-off distances for various types of building constructions typical of those at power reactors. All licensees would be required to review their sites against these criteria, and those sites meeting these criteria would certify this to the NRC. Staff estimates that this certification process would demonstrate that about 80 to 90 percent of the sites could meet these criteria without further analysis or consideration of additional measures.

Sites not meeting these criteria would have choices that would include using more substantial (and expensive) barriers for a portion of their protected area to reduce vehicle penetration, extending vehicle barriers beyond the protected area perimeter, performing a more detailed analysis of existing structures and equipment to demonstrate their ability to protect against a vehicle bomb using barriers at the protected area, or evaluating other alternatives.

Some licensees may be able to demonstrate that atypical building structures would provide adequate protection, that building damage-would not disable vital equipment, or, if vital equipment were damaged, that redundant or diverse equipment could provide a backup function.

If this capability could not be demonstrated, a licensee may have to establish additional security measures to assure protection from a vehicle explosive for vital equipment.

Examples of these measures are extending the hardened barrier outward from the current protected area boundary, placement 'of blast shielding, or providing backup systems for those assumed to be damaged.

For most sites (80 to 90 percent), the costs for Option 5 would be about

$50,000 more than Option 3.

This amount assumes a confirmation analysis that vital area structures meet staff specified' criteria for safe stand-off distances.

Many of the remaining sites would have choices available to i

provide equivalent protection with additional cost.

For the few sites where analysis indicated that stand-off distances may be less than those specified i

in staff guidance, Option 5 permits evaluation of alternative approaches.

In those cases where licensees determine additional security measures may be needed to protect safe shutdown capability, Option 5 would permit licensecs to

)

either implement the additional security measures or develop alternate i

protection strategies. Staff would review licensee's alternative proposals 1

and make an acceptability determination. The staff will accept the proposed alternative measures if they provide substantial protection against a land vehicle bomb and the costs of fully meeting the design goals' and criteria are disproportionate with the added protection which would be provided. _The Commission would be notified of such staff action.

j l

~

14 The Regulatory Analysis (Enclosure 6) contains the essential elements of the appropriate Backfit Analysis for this option, and a suitable Backfit Analysis will be included in the proposed rulemaking package.

Staff has concluded that Option 5 would significantly increase protection of the public health and safety.

Staff has also determined that the direct and indirect costs of implementation of Option 5 are justified in view of the increased protection.

Staff also notes that the determination on costs of implementation of Option 5 is based on the premise that the only definitive requirement for all licensees is that they provide measures to protect against the use of a land vehicle as a means of transportation to gain rapid access to vital areas and that they assess any incremental measures, if necessary to meet the design goal for a land vehicle bomb. A determination of whether incremental costs were disproportionate with incremental benefit would be made on a site-specific basis.

A summary of cost estimates follows for two cases, one where analysis demonstrates that safe standoff distances are within the present PA and one where the standoff distances go beyond the PA boundary.

1 Cost Summary case 1:

(Assumes analysis demonstrates safe standoff distances are within present PA - About 80 to 90 percent of sites)

Items Passenger Pickup Large Vehicle Truck Truck 1.

4 Active Vehicle 120/120 160/ 160 280/ 280 Access Barriers 2.

2,000/7,000' Passive 120/420 300/1,050 750/2,625 Barrier 3.

Standoff Analysis 50/ 50 50 / 50 50/

50 Total

$290/590K

$510/1,260K

$1,080/2,955K Cost Summary Case 2:

(Assumes analysis demonstrates standoff distances go beyond PA boundary for about 1/3 of boundary and further hardening of portions of PA barrier to penetration needed)

Items Passenger Pickup Large Vehicle Truck Truck 1.

4 Active Vehicle 120/120 160/ 160 280/ 280 Access Barriers 2.

2,000/7,000' Passive 120/420 300/1,050 750/2,625 Barrier 3.

Standoff Analysis 100/100 300/ 300 500/ 500 4.

Additional Measures 100/100 150/ 150 250/ 250 Total

$440/740K

$910/1,660K

$1,780/3,655K

. m A

15 4

?

Conclusion:

.-Staff has: concluded that Option 5'would significant1y' increase protection of, the public health and safety.

Staff has'also determined that the direct and indirect costs of implementation of!0ption 5 are justified.in view of the increased. protection.

Staff also notesithat the determination on; costs of implementation of Option 5'_is based on the premise that the only definitive requirement for; all licensees :is that they. provide measures to:.

protect against the use'of a land vehicle as a means of transportation to gain -

rapid access to vital' areas and that they assess any incremental measures, if necessary to meet tt > design goal for a land vehicle bomb.'

A' determination:of whether incremental costs were disproportionate with incremental benefit would be made on a site-specific basis.

7.0 IMPLEMENTATION 7.1 Rulemaking Options Rulemaking options with regard to the vehicle threat' would apply to implementation of a Commission decision to modify the DBT for radiological sabotage and to promulgate related amendments to 10 CFR 73.55. As noted a

previously, staff has concluded that the vehicle threat doeslnot present an

i immediate threat to nuclear power reactors and that' additional prudent' measures, based on a redefined DBT, will provide, at relatively low. cost, an-additional margin of prudence.

While normal rulemaking is-~an option, staff has focused its consideration on-the two more expeditious methods of rulemaking.

t Immediately Effective Rule:- Promulgate an immediately effe tive final' rule, allowing for public comment only on the final rule and. require'immediate implementation of licensee vehicle. bomb-contingency plans until permanent measures are-in p1 ace.

Pros: The most time saving course of action to achieve prompt and enforceable:

licensee response and to pruside protection against the.DBV threat.

Cons: Cannot be supported by a credible justification' of the _ reality and immediateness of the threat to negate the need for'two Administrative-Procedures Act requirements; publication of a proposed rule with opportunity for public' comment, and the 30-day prenotice ~of: effective date.

Presents a litigative risk due to eliminating prior public comment.

May present additional litigative risks to the extent that applicable Commission rules are not applied to enable a timely implementation, e.g.,10 CFR Part 51 (environmental review).

Exoedited Rulemakina:

Promulgate a final rule in'an expedited manner.

Pros: May significantly shorten the time between Commission decision and implementation.

e am w,-

[m.

.,+3 16 Eliminates litigat'ive risk due to eliminating prior public comment.

Cons:

Provides a shortened public comment period.

Resource intensive.

An additional point should be noted regarding rulemak' ng in general as applied i

to the DBT and 10 CFR 73.55. There is no categorical exclusion under Part 51 for this activity, and therefore, an environmental assessment is required.

In addition, both the proposed and final rules would have to be reviewed by the Committee to Review Generic Requirements and the Advisory Committee on Reactor Safeguards.

7.2 Guidance for Licensees As indicated above, staff intends to develop criteria that could be used by licensees to determine, through simplified site-specific analyses, that-protecting against vehicle intrusion into the PA would also provide substantial protection against a vehicle bomb with characteristics-of the type specified in Enclosure 8.

These criteria would specify safe stand-off distances for various types of building constructions typical of those at power reactors. The safe standoff guidance would consider such variables as wall and ceiling construction material; wall height, width, and thickness; the size, spacing and depth of rebar, and boundary conditions.

Staff anticipates that most licensees could certify the adequacy of their standoff distances using staff's guidance, without the need for more detailed-analysis.

For those licensees that choose to perform more direct analyses, staff could make available a.four volume security: engineering manual. prepared by the U.S. Army Corps of Engineers. These manuals include information on vehicle barrier design and penetration tests. Additional barrier testing results are available from the Naval Civil Engineering Laboratory and Sandia National Laboratories.

Staff also plans, with the help of the Army Corps of-Engineers, to provide guidance on extrapolating -data on penetration tests to barriers with different details of construction and'for.various soil' conditions.

Sites not meeting the criteria would have choices that would include using more substantial and expensive barriers for a portion of.their PA..(to reduce; vehicle penetration), extending vehicle barriers beyond the PA perimeter, performing'a more detailed analysis of existing structures and equipment to demonstrate their ability to protect against a vehicle bomb using barriers at the PA, or performing a qualitative analyses of alternatives. The qualitative analysis would address the enhanced protection that would be achieved by protective measures that exceed protecting against vehicle intrusion-into the PA.

Some of these licensees may be able to demonstrate that atypical building structures would provide adequate protection,-that building damage would not.

disable vital equipment, or, if vital _ equipment were damaged, that redundant or diverse equipment could provide a backup function.

If this capability could not be demonstrated, a licensee may have to establish additional t

17 security measures to assure an acceptable level of protection from a vehicle.

explosive for vital equipment.

Examples of these measures are extending the hardened barrier outward from the current PA boundary, placement of blast shielding, or providing backup systems.for those assumed to be damaged.

In those cases where the licensee determines additional. security measures are needed to protect a safe shutdown capability, this option would permit licensees to either implement the additional security measures, develop alternate protection _ strategies, or propose not implementing measures beyond-the PA boundary, along with a complete cost analysis. Staff would have to review the licensee's alternative solution against developed ~ criteria and make a determination on its acceptability.

For those licensees proposing not to implement additional security measures (beyond hardened PA perimeter), staff would need to make a determination of whether the costs were disproportionate with the incremental benefit. The Commission will be informed of the staff decision.

8.0 RECOMMENDATION That the Commission approve Option 5:

1) a modification to the DBT for radiological sabotage (10 CFR 73.1) to include the use of a vehicle for the transport of personnel, hand-carried equipment, and/or explosives

2) appropriate modifications to 10 CFR 73.55 to reflect the-change to the DBT and to allow for consideration of reasonable alternative security measures when the existing PA barrier does not provide safe stand-off distance, and

3) an expedited rulemaking to achieve this change.

i