Radioactive Source Security: Why Dirty-Bomb Preparedness Starts Before an Explosion
Explore how radioactive source security, lifecycle management, and emergency planning intersect with dirty-bomb prevention—and how Harvard Chan Advance Learning Academy’s Radiological Emergency Management: Regulations, Planning, Response, and Recovery program helps professionals connect prevention, response, and recovery.
Radioactive source security is easy to treat as separate from radiological emergency management. One discipline focuses on controlling radioactive material; the other prepares organizations to detect contamination, protect responders, manage casualties, communicate risk, and recover after an incident.
A radiological dispersal device, or RDD, shows why that separation can be misleading. Dirty bomb prevention begins long before radioactive material is dispersed. It starts wherever sources are acquired, licensed, used, secured, transferred, transported, and eventually taken out of service.
That upstream challenge remains unresolved. In June 2026, the U.S. Government Accountability Office (GAO) reported that the Nuclear Regulatory Commission (NRC) had implemented none of the nine priority recommendations GAO identified for the agency in May 2025. GAO again named radiological-source security among the areas requiring focused attention.
For hospitals, industrial facilities, research organizations, regulators, and emergency-management agencies, the finding raises a broader preparedness question: How well do everyday controls over radioactive material connect with planning for radiological terrorism?
Dirty Bomb Prevention Starts with Understanding the Risk
An RDD combines conventional explosives with radioactive material to spread contamination. It is not a nuclear weapon. The Centers for Disease Control and Prevention notes that the principal immediate danger from a dirty bomb is generally the explosion itself. Radioactive dust or smoke can spread beyond the blast area, but only people very close to the explosion would typically receive enough radiation to cause immediate serious illness.
Radiation-health effects, however, are only part of the potential impact.
GAO has argued that radiological security decisions should also consider socioeconomic consequences, such as loss of property access, economic disruption, and cleanup costs. Its 2024 review found differences in how federal agencies incorporate those consequences into decisions about protecting radioactive material.
NRC has taken a broader risk-management position, emphasizing that security decisions consider threat, vulnerability, consequences, existing regulations, and national capabilities for prevention and response. The disagreement is significant for preparedness professionals because it highlights how the consequences of an RDD can extend beyond radiation dose alone.
A contaminated site can also create operational, economic, communication, and recovery challenges. For organizations planning for an RDD, those consequences belong in the risk conversation before an incident occurs.
Radioactive Source Security and Category 3 Materials
One continuing policy question involves Category 3 radioactive sources.
The International Atomic Energy Agency categorizes radioactive sources according to the potential harm they could cause if not safely or securely managed. Category 3 sources can cause permanent injury after prolonged close contact with unshielded material and are commonly associated with applications such as fixed industrial gauges and well-logging equipment.
Category 3 material is regulated. The issue is not an absence of security controls.
NRC states that all radioactive material is subject to safety and security requirements. Category 3 sources must be secured against unauthorized access or removal while stored and kept under surveillance and control when not in storage. Additional requirements may apply based on how a source is used.
But the enhanced physical-protection requirements of 10 CFR Part 37 apply to Category 1 and Category 2 quantities of radioactive material. These requirements include additional controls intended to prevent theft or diversion of the most risk-significant sources.
GAO has questioned whether controls for Category 3 sources are sufficient. Its recommendations have included centralized tracking of Category 3 sources and licenses and stronger verification of licenses before material is transferred. In its 2024 review, GAO reported that NRC had not implemented those recommendations.
For organizations possessing radioactive material, the practical lesson is broader than the regulatory debate. Radioactive source security requires understanding not only what rules apply, but how inventories, access controls, license verification, transfers, physical protection, and emergency procedures work together.
Source Security Does Not End When Equipment is No Longer Used
Another vulnerability can emerge near the end of a radioactive source’s useful life.
Radioactive sources support legitimate medical, industrial, and research activities. When equipment is retired, however, its radioactive material does not simply cease to require attention.
GAO found that some licensees delay disposal of disused high-risk sources because disposal may be difficult, costly, or unavailable for certain materials. Keeping sources beyond their useful lives can increase the risk that they become lost, abandoned, or vulnerable to misuse.
The International Atomic Energy Agency similarly treats source security as a lifecycle responsibility. Its Code of Conduct applies to Category 1 through 3 radioactive sources and calls for appropriate safety and security throughout their lifecycle.
This makes disposition planning part of radioactive source security, rather than an administrative task to consider only after equipment has become obsolete.
Organizations can examine source control across acquisition, active use, storage, transfer, transportation, disuse, and final disposition. Vulnerabilities can emerge when responsibility shifts among radiation-safety personnel, facility security, vendors, regulators, transporters, law enforcement, and emergency-management teams.
Those handoffs deserve as much attention as the source itself.
How Can Organizations Strengthen RDD Preparedness Before an Incident?
Strong RDD preparedness does not mean treating every radioactive source as an imminent terrorism threat. It means integrating routine source management into the organization’s broader preparedness system.
Useful questions include:
- Does the organization know what radioactive material it possesses, where it is located, and who is responsible for it?
- Are access controls and physical security measures appropriate to the material and its use?
- Are licenses and recipients properly verified before material is transferred?
- Is there a defined and financially realistic disposition plan for sources that are no longer needed?
- Do radiation-safety, security, law-enforcement, emergency-management, communications, and health care partners understand their roles if material is lost, stolen, or deliberately misused?
- Do exercises focus only on what happens after an RDD detonates, or do they also test decisions and coordination that could prevent or limit an incident?
These questions do not replace regulatory requirements. They help organizations connect regulatory compliance, operational control, security, and emergency planning.
Radioactive Source Security and Response Belong in the Same System
No security program can eliminate the need to prepare for a radiological dispersal device. Likewise, sophisticated detection, decontamination, communication, and recovery capabilities cannot compensate for preventable weaknesses in the control of radioactive material.
Effective preparedness requires both perspectives.
Harvard T.H. Chan School of Public Health’s Radiological Emergency Management: Regulations, Planning, Response, and Recovery program reflects that intersection. The current curriculum includes responder RDD/IND protocols, managing terrorist incidents involving radioactive materials, planning for recovery through the Wide Area Resiliency and Recovery Program, and radiological-event simulations covering technical and media response. The program is designed for professionals involved in radiological planning, response, or recovery across the public, private, and nonprofit sectors, including private organizations that handle radioactive materials.
For those professionals, radioactive source security provides an important upstream view of the same problem addressed by emergency planning downstream. Prevention, security, response, communication, and recovery are not isolated functions. They are parts of one preparedness system.
Dirty-bomb preparedness therefore begins before an explosion—with how well radioactive material is controlled throughout its lifecycle.
