Capital Sources: Anatomy of a Nuclear Sting

Gregory Kutz and his colleagues wanted to order enough radioactive material to make a dirty bomb. So they set up bogus companies and applied for separate licenses from the Nuclear Regulatory Commission and the state of Maryland. They didn't succeed with Maryland, but they got a license from the NRC in less than a month. Then Kutz and his associates doctored the license to increase the amount of radioactive material they could buy, and began placing orders for nuclear moisture-density machines, which contain Cesium-137 and Americium-241. Suppliers were only too happy to help. Fortunately, Kutz is head of forensic audits and special investigations for the Government Accountability Office. His operation was a sting—one of about a dozen his team runs each year, most of them successfully. (The NRC has acknowledged some shortcomings, and moved quickly to address them.) Following testimony to a Senate subcommittee, Kutz explained the way the sting worked to NEWSWEEK's Jeffrey Bartholet. Excerpts:

NEWSWEEK: What were the names of the fake companies?
Gregory Kutz:
I can't tell you; we may use them again. One of the names we've actually used twice now. The one we were successful with we also used last year to cross the border from Canada and Mexico with radioactive materials sufficient to set off the radiation-portal monitors. The people behind the companies were fictitious people. We have undercover names. We have undercover credit cards.

If someone had Googled the undercover names, would they have come up with false profiles?
No, there was nothing behind the names. If they had done a credit check, there was no activity.

Did the names have Social Security numbers associated with them?

If a bad guy were trying to set up companies like this, how hard would it be to get a Social Security number?
They can probably buy a Social Security number on the street for $15 or $20.

I gather that the Nuclear Regulatory Commission helped you with the application process.
Yes, they were very helpful. We did the applications using publicly available information. And the applications can be downloaded online. There are instructions. We had to take radiological safety training, for example. So our person, using different names, actually took [online] training and had the real certificate, which actually helped him when he talked to the NRC representative, because he had a little bit of knowledge.

When you do this training, does somebody run a background check on you?
No, as long as you have a credit card and can pay the fee, you can take the training and get a certificate.

And the training teaches you what?
It's called radiological safety training and relates to the machines we purchased. It teaches you safety issues, different ways of handling materials and other types of background information of what a safety officer would need to know to do their jobs.

How did the successful application process take place?
We sent it in, and within two weeks, we got the first phone call from the NRC licensing official asking various questions. Very simple questions: what were we going to do with the moisture-density machines when we were done? So we put some additional information on paper and effectively amended the application [twice], and faxed the information in. … There were 28 days between when we applied when we got the license.

Did they ever ask to visit your facilities?
No, not the NRC. The state of Maryland called us and they said, "You won't get your license until we actually come and visit and inspect your office and your storage facilities." In our application, we had shown [photos of] storage facilities we took off the Internet. So if you read our application, it looked like we had a physical building. … The Maryland people wanted to come see our storage facility, make sure it met their standards, make sure we had an office and all that kind of stuff. The NRC obviously looked at the pictures and said, "This looks good." They never mentioned meeting us or coming to see our facilities. Now, my understanding is that NRC says they will visit you within a year of giving you the license. Of course our recommendation is that you should not give anybody a license until you've physically kicked the tires.

With the Maryland license, you cancelled the process at that stage.
We had not paid our fee yet, and didn't want to spend our thousand dollars, so we withdrew our application. We told them we were having financial troubles.

That didn't set off any alarms for them?
Not at all.

The NRC sent you the license in the mail?

Yeah, I won't give you all the details, but we basically had a Mail Boxes Etc. address, which can look just like a real address. And they mailed it to us. We didn't have to leave the office to do anything except check that mailbox.

Then you get the license and you doctor it. How did you do that?
We just used a word-processing machine here. We used commercially available hardware, software and information from the Internet. So we didn't have any special equipment. We scanned in the license. There's no watermarks, no counterfeit-proof security measure in the NRC licensing documents. So we just scanned it in and removed two paragraphs that limited how much of the materials we could actually get. We removed those and wrote two paragraphs in that basically gave us more of an unlimited quantity of Cesium-137 and Americium-241 that we could buy.

What happened next?
We approached two suppliers. And because you had to fax the license, we could have just done a cut-and-paste with glue and it would have worked. They accept faxed copies of your license. We did much more elaborate counterfeiting than we actually had to do.

Did the shippers do any background checks?
No. They were only interested in how we were going to pay. These are small businesses. They were very excited about our order. From one company we ordered 20 of the machines and they offered us 40. And they gave us a nice discount. They were very, very excited about the big order. And they were very, very crushed when we called and told them it was a sting.

How many companies around the U.S. could you have ordered from?
I don't know, but we stopped [at two] because we had reached enough to get to category three.

Explain "category three" for the layman.
Well, according to the International Atomic Energy Agency, that means that it's dangerous. In other words, you need to have it securely stored and it could do harm to individuals, either as a dirty bomb or if you were around it or handled it. The NRC talks about category one and two, and those [radioactive materials] come from nuclear plants and things like that. This is not nearly as significant as that. This, if used as a weapon, would be more of a dirty bomb than a weapon of mass destruction.

What was the reaction of NRC officials when you called them up and told them what you'd been able to do?
They haven't always been quite so responsive. But this time, right after we told them, I think the same day they suspended the licensing program. They took it very seriously.

Is there any evidence that bad guys have actually done any of this?
We don't know. NRC says they are going to look back for the past several years, and hopefully do some due diligence—make sure they've done a field visit for all of these places. One other thing that came up at the hearing we had was the supplier aspect: I think the NRC was quite discouraged that the suppliers didn't think [something was amiss]. Forty-five of these [nuclear moisture-density gauges] ordered by a start-up company is a lot.

Give me an idea of what we're talking about here: if you had 45 of these devices and that nuclear material was put in a dirty bomb, and that was exploded in downtown Washington, what kind of fallout would there be?
I think it's going to be more economic fallout than deaths of people. It would cause significant fear, panic and evacuations.

Do you mean the area would have to be evacuated for a significant period of time?
The NRC said a city block. Their analysis was that this could do significant damage to a city block. Could we have gotten more? Yes.

Do you lose sleep at night knowing how easy it is to counterfeit this stuff?
It is kind of scary that we don't get caught more. On the one hand, our goal is to beat the system. On the other hand, when we do, it' s a bit discouraging.