Three Mile Island Intruder

Regulation and Nuclear Plant Safety #2

A man recently released from a hospital where he had been treated for mental health issues drove his mother’s station wagon into—literally—the Three Mile Island nuclear plant near Harrisburg, Pennsylvania at 6:53 am on February 7, 1993. Workers responded to the unauthorized entry by locking the doors to the control room and declaring a Site Area Emergency—the second most serious emergency of the Nuclear Regulatory Commission’s (NRC’s) four classifications. The intruder was found more than four hours later hiding in the turbine building.

Less than three weeks later while the NRC was still evaluating the unauthorized entry of a vehicle into Three Mile Island, a rental truck loaded with explosives was detonated in the parking area beneath the North Tower of the World Trade Center in New York City. The NRC revised its security regulations to better protect nuclear plants against unauthorized vehicle entries and vehicle bombs.

The Scene

As suggested by its name, the Three Mile Island (TMI) nuclear plant is located on an island. This specific island is in the Susquehanna River as it flows southeasterly from Harrisburg, Pennsylvania. TMI is best known for the worst nuclear power plant accident, so far, in U.S. history. On March 28, 1979, the Unit 2 reactor at TMI experienced a partial meltdown of its nuclear core. The damaged Unit 2 reactor never restarted, but the Unit 1 reactor restarted a few years later and operated at 100 percent power on the morning of February 7, 1993.

At 5:30 am that Sunday morning, security officers opened the gates for the access bridge on the north end of the island (the upper left side of Figure 1). The night shift security personnel turned over duties to the oncoming dayshift crew at 6:00 am. Other dayshift workers and non-shift workers reporting for duty used the north bridge to drive onto the island.

The Party Crasher

At 6:53 am, a vehicle turned off Pennsylvania Route 441 onto the two-lane road to the north bridge. The vehicle continued past the North Gate guard house without stopping to show a badge authorizing access to the island and proceeded at an estimated 35 to 40 miles per hour in the outbound lane across the north bridge. The gates were still opened, so nothing impeded the vehicle’s unauthorized entry.

The vehicle slowed to 15 to 20 miles per hour as it exited the bridge and approached the plant. The night shift operations shift foreman who was in the parking out on his way home after being relieved from duty heard a crashing sound as the vehicle drove through Gate 1 into the protected area around the plant. The protected area detection system alerted security personnel to the gate-crasher.

The vehicle continued for another 189 feet until it smashed into the corrugated aluminum roll-up door at the northeast corner of the turbine building. The vehicle, with a portion of the roll-up door adorning its roof, travelled another 63 feet inside the turbine building until it struck a large container for radioactive waste. The impact slid the container about six feet across the floor.

The off-duty operations shift foreman went to the Processing Center (where individuals enter and exit the plant’s protected area) and called the control room to report “A guy just went through the fence and roll-up door. This is not a drill. Lock the doors to the control room.” The shift supervisor who answered the call in the control room did not recognize the excited voice and did not hear much of the warning message. Moments later, a security officer entered the control room and announced, “This is not a drill, someone crashed through Gate 1 and then drove into the auxiliary boiler door.” (Basically the same message, but when it’s delivered in person by someone toting a gun, it tends to be better heard and heeded.) The control room is located within the control building adjacent to the turbine building.

The Game of Hide & Seek

At 7:02 am, security officers approached the vehicle in the turbine building. The headlights were on, the engine was off, the driver’s side door was open, but no one was found in or around the vehicle. The security officers retreated because the vehicle could contain explosives.

At 7:07 am, the operations shift supervisor declared a Site Area Emergency. The NRC has four emergency classifications–Unusual Event, Alert, Site Area Emergency, and General Emergency.

At 7:11 am, the Central Alarm Station operator at TMI notified the NRC’s Operations Center about the situation and emergency declaration.

At 7:16 am, the operations shift foreman at TMI began notifying local and state officials about the emergency declaration. He used telephones in the control room instead of the automated notification system because it was in an office outside the locked control room doors.

At 7:23 am, the emergency director at TMI (who was also the operations shift supervisor) called the NRC via the Emergency Notification System telephone. The NRC asked that a direct telephone line to the plant be kept open.

At 7:33 am, the Pennsylvania State Police notified the Middletown Police Department about the security event at TMI. Middletown police officers arrived at the plant at 7:37 am.

At 8:30 am, workers removed restrictions on telephones at the plant. During weekends, the telephone system at the plant prevented many telephones, including some used for emergency response, from dialing offsite.

At 9:00 am, an explosive ordinance disposal unit from the U.S. Army surveyed the vehicle and observed no suspicious packages, containers, or wires.

At 9:28 am, the control room doors were unlocked to allow two workers to enter the shift supervisor’s office and activate the pagers to summon the emergency responders.

At 9:37 am, the NRC resident inspector, a representative of the state’s Bureau of Radiation Protection, and a company public affairs person with an armed escort walked through the turbine building and entered the control building.

At 10:20 am, the explosive ordinance disposal unit completed a more thorough search of the vehicle and found no bomb or “explosive paraphernalia.”

At 10:22 am, site security officers and Pennsylvania State Police officers begin searching for the intruder.

At 10:34 am, security personnel regrouped after completing the first search of the turbine building. Their search efforts had been hampered by dimly-lit areas inside the turbine building. To aid in future searches of darkened places, the team was given a flashlight.

At 10:36 am, the Emergency Director at TMI briefed the security team on the potential effects of using firearms in the turbine building (i.e., what could happen if bullets strike things other than intruder.)

At 10:40 am, the flashlight-equipped security team began a second search of the condenser pit area within the turbine building.

At 10:57 am, the security team found the intruder hiding in a dark area adjacent to a main condenser waterbox. The Pennsylvania State Police took custody of the intruder.

At 11:10 am, the explosive ordinance disposal unit completed a more detailed search of the vehicle and still found no bomb.

At 11:30 am, the explosive ordinance disposal units completed a search of the vehicle using an explosive detection dog. The dog didn’t find a bomb either.

At 11:45 am, the Pennsylvania State Police left the plant site with the intruder.

At 2:39 pm, cadets from the Pennsylvania State Police Academy arrive at the site by bus to search the entire island.

At 4:25 pm, the Site Area Emergency declaration was terminated.

The Intruder

The intruder was identified as a 31-year-old Caucasian male approximately 6 feet 1 inches tall and weighing 140 pounds with thick, black, shoulder-length hair and a heavy beard. At the time, he lived with his mother in a rural community northwest of Harrisburg about 56 miles from TMI.

The man had been admitted to hospitals at least three times for treatment of depression. The most recent hospitalization before this event had been an involuntary admission on January 18, 1993. He had been released on January 22.
The Earlier Intruder

This was not the first time that an unauthorized person had driven onto the island. At around 4:25 pm on April 23, 1980, a watchman at the North Gate observed a vehicle whiz by without stopping and reported the trespassing to the roving security patrol. A security alert was declared, the Pennsylvania State Police were contacted, and an extensive search begun. About four hours later, the trespasser was identified as a plant worker. The worker had been on the island, departed in his vehicle via the North Gate, and returned shortly afterwards. The worker said he’d not stopped on re-entering the site because he believed the watchman would know he was returning.

The Earliest Intruder

That was not the first time that an unauthorized person had driven onto the island, either. At 6:50 pm on January 27, 1976, a vehicle drove past the North Gate without stopping. Fifteen minutes later, a construction worker reported seeing someone climbing the security fence around the protected area. Twenty minutes later, workers called security to report hearing someone singing near the top of the reactor building. At 8:00 pm, the security officer at the North Gate who saw the vehicle whiz by him entering the island saw that same vehicle whiz by him leaving the island. The Pennsylvania State Police tracked down the individual from the vehicle’s license tag. The individual was voluntarily admitted into a local mental hospital. (Might as well admit him—he’d sneak in anyway.)

The NRC “Intruders”

The NRC dispatched an Incident Investigation Team (IIT) to TMI following the unauthorized entry. The IIT consisted of ten members supported by six technical staffers. The IIT identified several factors which impaired the response to the intrusion, including:

• There was no vehicle at the North Gate for security officers to use to pursue and intercept the unauthorized vehicle.
• The response was delayed by the time it took security personnel to obtain weapons from isolated storage locations.
• The search-and-clear efforts were poorly coordinated, delaying searches in some areas. In addition, security officers were not posted after some areas were cleared to ensure those areas remained clear.
• The reluctance of some security officers to use response weapons could have placed them at a disadvantage had they confronted an intruder equipped with design basis threat weaponry.
• The plant’s security personnel searched for explosive materials before the explosives ordinance disposal unit arrived, but they had received no training on recognizing explosives. (Note: When I toured TMI after 9/11, the security manager conducting the tour told us that security officers are required to search incoming vehicles for bombs, but they have received no training on what a bomb looks like.)
• While flashlights were stored in the security “ready room,” they were not retrieved and used during the initial search of the turbine building.
• The company conducted quarterly security response drills in the three levels of the Unit 2 turbine building, which is significantly different from the six levels within the Unit 1 turbine building where the real event transpired.

The Drive to More Secure Nuclear Plants

Five hundred and forty (540). That’s how many days elapsed between someone driving into the TMI turbine building and the NRC putting upgraded security regulations on the street.

The NRC had considered security threats posed by vehicles prior to February 7, 1993. For example, in a paper (SECY-86-101) to the Commissioners dated March 31, 1986, the NRC staff noted that the chain link fences surrounding protected areas of nuclear plants would not prevent a vehicle from crashing through. But the staff concluded that prompt response by armed security officers would mitigate any fence-crashers.

The Nuclear Control Institute (NCI) and the Committee to Bridge the Gap (CBG) jointly submitted a petition for rulemaking dated January 11, 1991, to the NRC seeking to upgrade the regulations on nuclear plant security to include protection against explosive-laded vehicles and boats. On June 11, 1991, the NRC denied the rulemaking petition on the grounds “that there has been no change in the domestic threat since the design basis threat was adopted [in 1979] that would justify a change in the design basis threat.”

The events of February 1993 prompted the NRC to reconsider earlier decisions. The NRC noted “The bombing at the World Trade Center demonstrated that a large explosive device could be assembled, delivered to a public area, and detonated in the United States without advance intelligence” and that “The unauthorized intrusion at the Three Mile Island nuclear power station demonstrated that a vehicle could be used to gain quick access to the protected area at a nuclear power plant” (Federal Register, page 58805, November 4, 1993.)

The NRC conducted a Commission briefing on the re-evaluation of the design basis threat of nuclear plant sabotage on April 22, 1993. The NRC held a public meeting on better protection against vehicle intrusion and vehicle bombs on May 10, 1993. The NRC issued a draft rule titled “Protection Against Malevolent Use of Vehicles at Nuclear Power Plants” for public comment on November 4, 1993. And the NRC issued the final rule on August 1, 1994.

The upgraded rule required owners to evaluate their plants for potential damage from detonation of a vehicle laden with explosives and then either install barriers preventing vehicles from getting close enough to cause harm or provide structures protecting vital equipment from blast effects.

UCS Perspective

In reviewing momentous events for possible candidates in this series, this event appeared unquestionably to fall into the “just right regulation” bin. It ultimately found its way into that bin, but it became a bank shot rather than the swish or slam-dunk it initially appeared to be.

Slightly more than two years before the TMI intrusion, two non-governmental organizations petitioned the NRC to update its regulations to require protection against vehicle bombs. The NRC took only five months to deny that petition on grounds the perceived threat was really no threat.

Slightly less than 18 months after the TMI intrusion, the NRC revised its regulations to require protection against vehicle bombs.

A strong argument could be made that the NRC had sufficient cause in 1991 to update its regulations. After all, the TMI intrusion and the World Trade Center truck bombing were the very kinds of threats cited by NCI and CBG in their petition and became the leading reasons cited by NRC in 1994 for the revised regulations. This compelling argument could readily persuade an impartial jury to place this event in the “under-regulation” bin.

The counter argument would point out that the NRC addressed the petitioners’ concerns one-by-one. For example, the petitioners identified rise of State-sponsored terrorism as evidence of the need for upgraded security requirements. The NRC responded to this concern contending that unrest has been experienced in other parts of the world, it hasn’t happened here. The NRC also observed that it relies on U.S. intelligence efforts to identify, and thwart, larger coordinated attacks.

In issuing upgraded security regulations on August 1, 1994, the NRC explicitly conceded that it had denied the NCI/CBG petition seeking that outcome just three years earlier. The NRC noted that “The vehicle bomb attack on the World Trade Center represented a significant change to the domestic threat environment that changed many of the points used in denying the petition and eroded the basis for concluding that vehicle bombs could be excluded from any consideration of the domestic threat environment.”

Because the NRC did not stick by its 1991 denial and took steps after the events of February 1993 to better protect nuclear power plants—and more importantly, the people who work in them and live around them—from sabotage using vehicles, this event goes into the “just right regulation” bin. It would never make it into the “just perfect regulation” bin, but also does not deserve to fall into the “under-regulation” bin.

There’s more than a hint of the Nielsen Ratings Commission (NRC) and media spotlight effect described in the Role of Regulation #1 commentary. The NCI and CBG petition garnered trade press coverage. The TMI intruder event garnered local coverage. The World Trade Center bombing days later received international media coverage for weeks. That’s a powerful spotlight helping the NRC see the need for better protection against vehicle bombs.

* * *

UCS’s Role of Regulation in Nuclear Plant Safety series of blog posts is intended to help readers understand when regulation played too little a role, too much of an undue role, and just the right role in nuclear plant safety.