Nearly three dozen nuclear power plants are inadequately protected against major flooding guaranteed to occur after an upstream dam failure – flooding that could easily lead to an accident or meltdown on the scale of the 2011 nuclear power disaster in Fukushima, Japan.

Yet, the Nuclear Regulatory Commission (NRC) – the federal agency responsible for protecting public health and safety from nuclear power mishaps – has been downplaying the risk and failing to ensure that the measures needed to avert disaster are implemented.

Even more troubling, the agency is deliberately concealing the threat by withholding critical information from the public eye, according to a handful of experienced NRC engineers and risk analysts. For voicing their concerns to management regarding this dangerous vulnerability and seeking internal resolution of the problem, these conscientious federal employees have been met with resistance and retaliation.

Federal whistleblower Lawrence (Larry) Criscione, a nuclear engineer who joined the NRC as a reliability and risk analyst in October 2009, became so troubled by the Commission’s lack of responsiveness to staff warnings and the unwarranted secrecy he was witnessing that he sent a set of detailed letters and supporting documents to Members of Congress in September 2012. The NRC has marked vast numbers of its documents regarding the flooding risk as “Official Use Only – Security Related Information” – one of many such “over-classification” designations Government Accountability Project has been fighting for years. Criscione’s outreach to Congress, protected by law, was in support of a similar letter sent by NRC risk analyst Richard Perkins to the agency’s Inspector General (IG), Hubert Bell. After Congressional staffers apparently leaked Criscione’s letter and associated documents to the media and a story was published, two armed agents with the IG’s office interrogated Criscione in January 2013 and threatened him with felony charges and imprisonment. Though the Justice Department soon determined no felony had been committed, Criscione was so troubled by this clear act of retaliation that he took legal action to protect his federal whistleblower rights. Represented by legal counsel at Government Accountability Project, Criscione filed formal complaints with the US Office of Special Counsel (OSC); his whistleblower retaliation case is still pending, and Criscione voices his concerns publicly whenever afforded the opportunity.

What troubles CSPW – and should trouble us all – over the irresponsible and inappropriately secretive manner in which the NRC is mishandling the vulnerability of nuclear plants to flooding – is that the actual likelihood of a major nuclear incident caused by flooding is even greater than the probability determined by NRC’s risk analysis engineers. This is because their risk assessment calculations rely on past precipitation data that is not representative of the harsher weather and climate conditions we see today, such as severe storms and increased precipitation levels in certain regions of the US, caused by climate change. In fact, we see no evidence that the NRC is considering climate change impacts at all, as it evaluates overall risk of a nuclear power accident.

Nuclear Power is Often Touted as a Solution to Climate Change…
But How Does Climate Change Affect Nuclear Power?
For nearly half a century, US policymakers intent on mitigating the climate change threat have struggled to determine the energy mix that reliably and safely meets the nation’s energy needs but is less carbon-intensive and relies less heavily on fossil fuels than does our current portfolio. Many energy experts assert that nuclear power takes a rightful place alongside other low-carbon technology options such as solar photovoltaics, wind turbines, and other renewable energy systems; increased energy efficiency; and carbon capture and sequestration from coal-fired power plant emissions.

Unlike coal, nuclear energy offers a relatively clean, low-carbon energy source for generating baseload electricity. For this reason, many experts view nuclear power as an attractive choice for meeting our growing energy demand while fending off the more catastrophic impacts of climate change. While coal-fired power plants generate well over a third of the power we rely on – and are responsible for over two-thirds of the carbon dioxide emissions in the electricity generation sector – nuclear power now meets 20 percent of the electric power demand, with negligible CO2 emissions.

Proponents for nuclear power claim it is a far better choice than natural gas for providing baseload power and for bringing down atmospheric greenhouse gas levels to levels that could limit global warming to 2 degrees Celsius. When he was still at the NASA Goddard Institute for Space Studies, climate scientist and former Government Accountability Project client Jim Hansen and Pushker Kharecha calculated that nuclear energy use in the US had avoided 64 billion metric tons of greenhouse gas emissions in the period between 1971 and 2009, or about 2.6 gigatons of CO2-equivalent per year. Moreover, nuclear power generation had displaced energy from fossil fuel combustion and thus avoided emissions of toxic and hazardous air pollutants, preventing 1.84 million air pollution-related deaths during the same time period, or an average of 76,000 deaths per year (Environmental Science and Technology, March 15, 2013).

Detractors of nuclear power cite the nation’s decades-long failure to establish a permanent repository for high-level radioactive waste, the high cost of construction, and serious public health and safety issues primarily related to the potential release of radioactivity to the environment, and to the risk of a nuclear disaster as the result of reactor core meltdown. Among the deleterious effects of nuclear power, a nuclear meltdown has to top the list of potential dangers; it is therefore only logical and reasonable to demand that the regulatory agency in charge of nuclear safety, the NRC – whose motto is “Protecting People and the Environment” – reassess the risks to the licensed nuclear power plants identified as being vulnerable to flooding, and to demand corrective action.

At present, the US has 99 nuclear power reactors in operation at 61 nuclear power plants located in 30 states, mostly east of the Mississippi River (see the adjacent map and NRC’s online map of all of existing reactors). Most of these plants were built between 1970 and 1990: the oldest of them – Oyster Creek nuclear power station (NJ) and Nine Mile Point nuclear station (NY) – came online in 1969. The NRC issues new licenses for a period of 40 years; expiring licenses can be renewed twice, each for an additional 20 years. More than 80 reactors are now operating under a renewed license; only a handful have been shut down and decommissioned. As our nuclear fleet ages, ensuring public health and safety presents mounting challenges.

The vast majority of the licensed plants identified as being vulnerable to flooding, especially following an upstream dam failure, are located in the eastern regions of the US, many in areas where annual precipitation is expected to increase as the result of climate change. These facilities are subject to more frequent, extreme weather events, such as stronger hurricanes, which means they are more vulnerable to flooding events of the caliber needed to trigger significant release of radioactivity or even reactor meltdown.

In considering how we can optimize electricity production to fend off catastrophic climate change impacts, we cannot afford to neglect the deleterious effects of climate change impacts – e.g., heat waves, extreme weather events including deadlier hurricanes, prolonged droughts, severe flooding – on energy production technology and infrastructure.

The Nature of the Problem: “You Can’t Have Too Much Water in a Nuclear Reactor”
If asked, “What is most likely to cause a disastrous accident at a nuclear power plant?” most people would probably list things like human error, intentional tampering in acts of terrorism, earthquakes, or tsunamis (such as the one that caused the 2011 Fukushima disaster). Some worry about hackers; while it’s true that Russia has been hacking into our electric grid for some time, and attempts recently became so frequent that the US Computer Emergency Readiness Team issued an official alert, nuclear power plants are essentially immune from the sort of hacking that could disrupt plant operations (see “Russia Hacks Into U.S. Power Plants, But Nuclear Reactors Should Be Impervious,” Forbes, March 16, 2018).

After nearly 50 years living with nuclear power, few worry about nuclear accidents and view them as rare occurrences. However, there was a time when the general angst was higher than it is today. Baby boomers may recall a vintage Saturday Night Live (SNL) skit in which the nuclear power plant workers throw a retirement party for their manager, played by Ed Asner. On his way out, he leaves the employees (played by Julia Louis-Dreyfus, Gary Kroeger, and Rich Hall) parting advice: “You can’t have too much water in the nuclear reactor!” The double meaning causes confusion: should the night shift put a lot of water in the reactor core because no amount is too much, or should they take the advice literally? Ultimately, they decide to drain the reactor, and the skit ends with a scene of Asner sitting on a beach, gazing off into the distance, muttering to himself, “You can never look too long at a nuclear cloud.” The episode aired in November 1984 during the heyday of nuclear power plant construction, five years after the accident at Three Mile Island in Pennsylvania.

The correct interpretation of “you can’t have too much water in the nuclear reactor” is, of course, that nuclear reactors require a constant supply of cool water circulating around the core to avoid heat buildup that can, in its absence, quickly lead to temperatures high enough to melt the fuel rods and cause a meltdown that quickly leads to the release of large amounts of radioactivity into the surrounding environment.

A nuclear meltdown is no joking matter. While the term is not a technical one, it refers to the case in which the fuel rods reach temperatures that exceed their melting point. Fuel rods typically consist of elements such as uranium, plutonium, or thorium, and nuclear fission products such as cesium-137 and iodine-131. In a meltdown, these highly radioactive fuel elements leach into the coolant water, and when protective layers breach and subsequent failures occur, these radioisotopes can escape into the environment, either as radioactive water, or as radioactive gases in super-heated steam that escapes and forms a plume, is carried away from the plant by prevailing wind currents and becomes fallout. Cesium-137 and iodine-131 are beta- and gamma-ray emitters, meaning that radiation poisoning from these radioisotopes is extremely harmful and dangerous. If enough radioactive material escapes the containment vessels and is carried out into the surrounding environment, the consequences are devastating: a large area must be evacuated, and the long half-life of the radioisotopes means the area can most likely never be re-inhabited, creating a permanent dead zone. Myriad safety features now required, including redundant containment structures, is one of the main reasons nuclear power plants are so expensive to build.

Fukushima
As it turns out, Ed Asner’s parting wisdom in the SNL skit was incorrect: you can definitely have too much water in a nuclear reactor. Extreme flooding conditions in and near nuclear power plants present a grave risk.

In no case has this been more starkly illustrated than in the cascading events that occurred at the Fukushima Daiichi Nuclear Power Plant in March 2011. An earthquake far off the coast of Japan caused a tsunami; giant waves of ocean water came roaring over a 30-foot seawall, inundating the entire plant.

The sudden, massive flooding destroyed the plant’s emergency electric power systems and, with no way to pump cooling water into the reactor core, within a matter of hours led to the meltdown of three reactor cores. The explosions and fires, and the release into the environment of massive quantities of radioactive pollution, required over 100,000 people to be evacuated. Now, seven years later, only a small fraction of those who were suddenly displaced have been allowed to return. A large portion of the oceanic plume containing significant concentrations of radionuclides, predominantly Cesium-137, traveled eastward and reached waters off the US’ West Coast and Canada’s British Columbia within 16 months.

A formal investigation revealed that the plant operator, Tokyo Electric Power Company (TEPCO), knew that the causes of the accident were foreseeable, but decided against implementing preventive measures out of fear of lawsuits or protests against its nuclear power plants (see “Japan Power Company Admits Failings on Plant Precautions,” The New York Times, October 12, 2012. Critics of the NRC charge the agency with the very same mindset that led to the Fukushima disaster: regulators wish to avoid controversy and public criticism. It is easier for them to defend inaction or inexpensive action than it is to defend expensive precautionary measures for low-probability scenarios.

The Fukushima disaster – reminiscent of the horrific nuclear accident at Chernobyl in 1986, and the much less severe but worrisome accident in 1979 at the Three Mile Island (TMI) nuclear power station in Pennsylvania – alerted nations across the globe to reevaluate their safety measures.

NRC Regulatory Response to Fukushima: It’s Not What You Would Expect
At first glance, it looks as though the NRC has been taking the threat of a Fukushima-like disaster in the US seriously and has been requiring precautionary measures. For example, in May 2011 the NRC issued a formal request for information to all of its licensees inquiring how they would handle major floods or other extreme events, and told its inspectors to independently assess each plant’s level of preparedness. A special NRC task force was created to review safety regulations to determine what additional actions, if any, were needed to ensure the safety of US nuclear power plants in light of what happened in Japan. To lead implementation of the task force recommendations, the NRC created the Japan Lessons Learned Project Directorate (JLD) and a steering committee made up of NRC senior managers. The NRC even created a dedicated webpage: Japan Lessons Learned.

In July 2011, the task force issued a report (PDF), “Enhancing Reactor Safety in the 21st Century” – note the title of the report is not “Ensuring Reactor Safety” – that recommended about a dozen broad “enhancement areas” for the NRC to consider. It concluded that US reactors could “continue operating safely” while the NRC considered enhancements to the existing safety and emergency preparedness requirements in place at the time.

In March 2012, the NRC’s JLD issued a “Mitigation Strategies Order” that allows licensees to implement strategies that allow them to cope temporarily without permanent electrical power sources, which keep the reactor core and spent fuel cool, and protect containment buildings. Guidance was issued for “diverse and flexible coping strategies,” collectively referred to as FLEX, that involve using a combination of currently installed equipment (such as steam-powered pumps), additional portable equipment stored on-site, and equipment that can be flown in or trucked in from support centers. Much of the NRC guidance for mitigation equipment was developed by the Nuclear Energy Institute (www.nei.org), a research and lobbying group for the commercial nuclear industry. Criscione and others argue that the FLEX system gives the appearance that controls are placed on the equipment, but none of it is enforceable as it is under licensing requirements. Thus, no matter how deficient FLEX equipment was found to be, no plant would have its operations restricted. By contrast, design basis equipment is routinely surveilled and inspected to ensure it will function when needed, and if the equipment becomes inoperable, the affected reactor(s) must be shut down.

Criscione and several of his colleagues at the NRC believe that nuclear power plants should rely on design basis equipment – not mitigation equipment – required by plant licenses, and capable of surviving major floods. They believe that the equipment necessary to safely shut down the reactor and remove its decay heat (to prevent core damage and meltdown) should be intact and available for use following a credible flooding event at the reactor site.  They take strong issue with claims that mitigation measures are enough to ensure safety.

Instead of building upon and improving what was already in place, the Commission weakened the overall structure of flood control safeguards in place, they allege. The NRC switched from a pre-Fukushima safety system that required design-based protection barriers (i.e., permanent features such as installed barriers) –  a system that was verifiable and enforceable because it was built into the licensing process – to a post-Fukushima system of uncontrolled (meaning, voluntary and unenforced) mitigation strategies. Moreover, evidence exists that the trend toward a preference for mitigation over protection was driven by a motivation to minimize cost in an effort to maximize profit for the commercial nuclear industry. Meanwhile, the agency continued to allege that the risk of a flooding-induced meltdown was simply too remote to warrant taking adequate (i.e., expensive) preventive measures. (These key points and others can be found in a lengthy set of comments Criscione submitted as part of his federal whistleblower case.)

Q: How Many Potential Fukushimas Are in the US?
A: Too Many
Vulnerability of coastal nuclear power plants to sea level rise and storm surges:
Simply by virtue of being located near the ocean’s edge, some of the nation’s nuclear power plants are increasingly vulnerable to flooding as the result of storm surges, in the nearer term, and to sea level rise, in the longer term. At least four nuclear power plants located along the East Coast have been identified as vulnerable to storm surges occurring as the result of extreme weather events, such as hurricanes: Salem Nuclear Generating Station (NJ), Hope Creek Nuclear Generating Station (NJ), Millstone Nuclear Power Station (CT), and Seabrook Station Nuclear Power Plant (NH – see studies by the Union of Concerned Scientists (UCS) and Stanford University, published in Environmental Science and Technology, May 16, 2013). Adding taller, stronger sea walls is one important preventive measure that could avert a nuclear accident caused by flooding.

Vulnerability of inland nuclear power plants to flooding and upstream dam failure:
Nuclear power plants located inland, and that draw on a water supply created by a lake or water impoundment created by a dam, are susceptible to flooding in the unfortunate event that a dam should fail. So too are nuclear power plants located downstream of any dam, irrespective of the cooling water supply, and plants that are located in floodplains prone to excessive flooding.

NRC engineers assigned to risk assessment have warned that it does not even take a dam break to cause flooding severe enough to cause a serious accident. They have identified four reactors that are susceptible to riverine flooding. Two of these reactors (units 1 and 2) at the Quad Cities Generating Station, are located on the banks of the Mississippi River near Cordova, Illinois. This nuclear power plant was sited in the 1960s and built in the early 1970s and would be ineligible for a license under today’s standards. Owned and operated by the Exelon Corporation, the facility has no protective barriers sufficient to keep away flood waters and has no protective measures planned. Instead, Exelon’s plan for dealing with plant failure resulting from flooding is to open up the reactor vessels so as to flood the cores with river water, and to use gasoline-powered pumps to add more water as it boils off, according to staff at NRC who report being troubled by the lack of adequate measures.

Two reactors (units 2 and 3) at Dresden Generating Station, located at the head of the Illinois River near Morris, IL, are also susceptible to flooding should the Illinois River water spill its banks. According to a 2012 report to the NRC generated by Exelon after a “flooding protection walkdown” – or, a detailed, physical inspection of the plant – Exelon would have little or no warning of high river levels at the water intake, and part of their response plan is to relocate pumps in ways that some NRC staff believe would lead to potential pump failure.

Because of their vulnerability to flooding, the nuclear power plants at Oconee, Dresden, Quad Cities, and Monticello would not be allowed to be built today at their current locations.

According to NRC staff, the agency has been all too ready to accept “outlandish solutions” to riverine flooding proposed by licensed operators at Quad Cities and Dresden. They charge that the NRC “is allowing reactor owners to address credible flood hazards by relying on mitigation equipment that is not controlled by the plants’ Technical Specifications, is not subject to the plants’ quality assurance program, and is not monitored under the Maintenance Rule requirements.” This regulatory jargon essentially means that the NRC is giving too much leeway to licensees regarding how they plan to deal with the flood risk and is not building in appropriate NRC oversight to ensure that claims made by licensees regarding the effectiveness of proposed measures are valid.

What the NRC Does Not Want the Public to Know
Following the Fukushima disaster, the NRC conducted another analysis of the flood risk. The resulting July 2011 report, “Screening Analysis Report for the Proposed Generic Issue on Flooding of Nuclear Power Plant Sites Following Upstream Dam Failures” was prepared by Richard H. Perkins, Michelle Bensi, Jacob Philip, and Selim Sancaktar. The lead author, Richard Perkins, has been a risk engineer for the NRC since 2008.

Initially, the NRC withheld the entire report from the public, and labeled it NOT FOR PUBLIC RELEASE. Later, the NRC made available a significantly redacted version of the Screening Analysis Report on its website, with the following forward:

Due to the sensitive nature of some information in this analysis, redactions are necessary in this public version. The NRC has coordinated with other Federal agencies (Department of Homeland Security, Federal Energy Regulatory Commission, and U.S Army Corps of Engineers) on the sensitivity of the redacted information.

Every NRC document that deals with the flooding risk at nuclear power plants has this banner across the top:

National security concerns have led to a situation in which certain kinds of information, such as predicted flood levels following a dam failure, are withheld from the public in the name of national security, presumably because such information would be useful in a potential act of terrorism. However, if the public – and the state and local governments that represent them – lack access to key information regarding the likely consequences of a dam failure, they cannot plan and prepare for disaster and are thus more vulnerable. As climate change impacts grow more severe, such as increased precipitation and flooding, climate change itself, much more so than terrorism,  becomes the predominant threat to national security.

One interpretation of the findings in the screening report is that US has about three dozen potential Fukushima-style nuclear disasters waiting to happen. The NRC noted that dam failure incidents in the US are common and determined that a total of 34 nuclear reactors, listed below, are situated downstream from more than 50 dams and face flooding hazards larger than they are able to withstand.

Alabama:                  Browns Ferry (Units 1, 2, 3)

Arkansas:                 Arkansas Nuclear (Units 1, 2)

Louisiana:                Waterford (Unit 3)

Minnesota:               Prairie Island (Units 1, 2)

Nebraska:                 Cooper; Fort Calhoun

New Jersey:              Hope Creek (Unit 1) and Salem (Units 1, 2)

New York:                 Indian Point (Units 2, 3)

North Carolina:       McGuire (Units 1, 2)

Pennsylvania:          Beaver Valley (Units 1, 2); Peach Bottom (Units 2, 3)

Tennessee:                Sequoyah (Unit 1); Watts Bar (Unit 1);
                                    Three Mile Island (Unit 1)

Texas:                        South Texas (Units 1, 2)

South Carolina:       H.B. Robinson (Unit 2); Oconee (Units 1, 2, 3)

Vermont:                   Vermont Yankee

Virginia:                    Surry (Units 1, 2)

Washington:            Columbia

The report’s four authors, Criscione, and others were concerned that the report contained information the public needed to know. The NRC’s decision to withhold the report from the public was a prime motivation behind Criscione’s September 2012 letters to Members of Congress and high-level officials at the NRC. An unredacted version of the report labeled “Not For Public Release” was provided to the Huffington Post in October 2012, via someone at Greenpeace who had obtained the report from one of the Congressional offices that Criscione had contacted a month earlier. A comparison of the two documents quickly reveals that information specific to the flooding risk is considered sensitive by the NRC.

The NRC redacted large amounts of text that includes references to potential flood levels, specific information regarding the flood risk as originally assessed by Duke Power in 1992, and data on the Probable Maximum Flood (PMF) for Oconee and other nuclear power plants vulnerable to flooding. The agency also blacked out aerial images showing the distance of the Oconee Nuclear Station to the Jocassee Dam, and figures depicting a cross-section of the dam.

The redactions are so extensive that the report is essentially unusable. All information explaining the risks these plants pose to the public has been blacked out. (See image of an example page).

On at least four separate occasions in June and July 2013, technical staff and managers from five NRC divisions met with agency attorneys to discuss how to resolve inconsistencies in the way the agency had been releasing information to the public regarding the risk of flooding at licensed power plants. The main topics of concern included scientific uncertainties in models for predicting flood heights; estimations of risk regarding the failure of upstream dams due to acts of nature such as probable maximum precipitation events; and risks due to latent design/engineering failures. “These are things that scientists and engineers should be consulting with one another about,” Criscione has repeatedly asserted.

Instead, NRC staff were busy figuring out how to justify the continued withholding of flooding information, including putting limits on responses to Freedom of Information Act (FOIA) requests. The agency also began to restrict access to flooding-related records in its Agencywide Documents Accession and Management System (ADAMS). Only the staff assigned to work on a specific project could gain access to records pertaining to that project. In addition, staff were prohibited from discussing projects to which they were assigned with staff not similarly assigned. The objective, according to Criscione, was to create information “silos” to ensure that “rogue” staff would not, directly or indirectly, pass embarrassing information to the public.

The NRC’s systematic withholding of nuclear safety issues concerning dam failures from the public is being done under the guise that release of such information could “reasonably be expected to endanger the life or physical safety of an individual,” and exemption provision under the Freedom of Information Act.

Duke Energy’s Oconee Nuclear Station, Upstream Dam Failure, and Flooding
One of the nuclear power plants that is particularly at risk of a major flooding event is the Oconee Nuclear Station (ONS) in South Carolina, about 10 miles north of Clemson University. NRC whistleblower Larry Criscione has articulated his concerns regarding this risk to Congress and the public, but his overtures for more effective action have been ignored by NRC management.

Tucked away in the northwestern-most corner of South Carolina, the region known as the Jocassee Gorges is heavily forested, marked by icy-cold rivers, wild trout streams, and several magnificent waterfalls; the area is so spectacular that National Geographic listed it as 9th on a list of the World’s 50 “last great places.” The name Jocassee is Cherokee and means “place of the lost one” – and derives from a legend in which a young Jocassee girl falls in love with a boy from an enemy tribe across the river, the Eastatoees, who dies in battle. The area gets as much as 100 inches of rainfall each year; so much so that the forest is categorized as a temperate rain forest.

Home to wildlife that includes black bears, bobcats, bald eagles, peregrine falcons – and more than 60 rare plant species that includes the lovely little Oconee Bell, a rare wildflower exclusive to the region.

Timber companies owned most of the land in the 1800s; in the mid-1900s Duke Energy began acquiring large parcels of land to expand its hydroelectricity operations. Duke announced construction of what was known as the Keowee Toxaway hydroelectric project in early 1965, began development in 1967, completed the embankment dam in 1973 across a section of the Toxaway River, and created Lake Jocassee and Lake Keowee. What had been known as the Jocassee Valley was now flooded; the area had been home to hundreds of permanent residents and was a popular spot to visit: an old hotel, the Attakulla Lodge, still stands at the bottom of Lake Jocassee, under 300 feet of water. There you will also find Mount Carmel Cemetery, the spot where the famous scene in “Deliverance” was filmed; adventurous divers still tour the underwater graveyard.

The Jocassee Dam is what is known as an earth and rockfill structure: it is 385 feet high and 1,800 feet long. The water inundated more than 7,500 acres, created 75 miles of shoreline, and, at “full pool” the water reservoir has a storage capacity of 1,185,000 acre-feet. Floodwater is released through a spillway controlled by two 40-by-32-foot gates that can handle a flow rate of 45,700 cubic feet per second. A 710-megawatt (MW) pumped storage hydroelectric station at the dam site generates peaking power (811 million kilowatt-hours/year) from four turbines, two of which were installed in 1973, the other two in 1975. A second dam on Lake Keowee, the Keowee Dam, also has a hydro plant, the Federal Energy Regulatory Commission (FERC) licenses both dams.

As Duke Energy was building the two dams and the two hydropower stations, it was also constructing the Oconee Nuclear station (ONS), located on the shore of Lake Keowee, approximately 8 miles northeast of Seneca and about 11 or 12 miles north of the campus of Clemson University. ONS Unit 1 came online in July 1973, Unit 2 came online in September 1974, and Unit 3 came online in December 1974. Note, the Nuclear Regulatory Commission was established in 1975, so all three units were inspected and licensed by its predecessor, the Atomic Energy Commission (AEC).

During initial licensing, Duke reported to the AEC that the Jocassee Dam was constructed using sound civil engineering methods and to the same seismic standards as the plant, and that the probability of dam failure was very low; based on this assurance, the AEC did not require Duke to demonstrate protection for a failure of the Jocassee Dam.

According to an NRC document, “Jocassee Dam Oconee Flood Issue May Take Many Years to Address” (no longer available), the potential for flooding at ONS following an upstream dam failure was first formally addressed by the NRC in 1977. The new agency had established a program called the Systematic Evaluation Program (SEP) to review the designs of 10 of the 51 nuclear power plants that predated the creation of the NRC in 1975. The evaluation program identified a total of 27 issues across all 10 plants, many of which were related to dam integrity and the potential for site flooding; the remaining 47 plants were then evaluated, including ONS. The NRC had also identified a set of Generic Safety Issues, one of which was Dam Integrity and Site Flooding, which was assigned the nomenclature Generic Safety Issue 156.1.2, for determining whether any upstream dam failure could cause significant flooding at any of the licensed plants. To add to the bureaucratic-ese, the NRC charged the agency’s Individual Plant Examination of External Events (IPEEE) program with ensuring all problems identified in the evaluation were adequately addressed and closed out.

At this point, it should have been obvious to all that a catastrophic failure of the Jocassee Dam would lead to massive flooding at the ONS site, and likely result in reactor trips, loss of AC power, and the inability to continue pumping cool water through the reactor cores needed for heat removal. The central concern is that a dam failure would result in flooding so severe that it would jeopardize the Standby Shutdown Facility (SSF) at ONS, which would quickly lead to a meltdown. However, at this juncture and at several critical points throughout time, no meaningful action was taken that ensured the plant’s integrity and operation following a major flood. In 1977, Duke Energy assured the NRC that it had recovery action procedures in place, and that the three reactor containment buildings where Units 1, 2, and 3 were housed would remain intact during the initial flooding – and the NRC took their word for it.

NRC’s Historical Handling of the Flooding Risk
Internal NRC documents reveal that the agency has been aware of and addressing flooding risks at the Oconee Nuclear Station going all the way back to 1978 (summarized in an NRC internal memo dated December 2006). Several licensee memos to file and other documents addressing flooding risk assessments, dated throughout the 1980s and 1990s, contain many statements indicating a significant risk of flooding at ONS following a Jocassee Dam failure. Representative of the conclusions drawn in these documents is this alarming statement: “If a sudden failure of Jocassee Dam were to occur, and a rapid enough release of the impounded water from Lake Jocassee into Lake Keowee resulted, the flood wave generated in lake Keowee would overtop Keowee Dam and the Oconee intake dike, flooding the plant.” A 1992 inundation study conducted by Duke predicted that flood waters following a dam failure that would rise to a level well above the 5-foot walls that protected the SSF.

However, when Duke finally responded to the 1991 request in 1995, it relayed to the NRC its conclusion that the probability of core damage (expressed as core damage frequency, or CDF) following dam failure was simply too low (7E-06/year) to require any further action. For non-math wizards, 7E-06 translates to 7 times 10 to the negative 6, or 0.000007 – or for gamblers, Duke gave core reactor damage in dam failure flood conditions a chance of one in 143,000. This is the way Larry Criscione puts it:

The probability of being dealt a Royal Flush in 7-card poker is about 1 in 32,000 so according to Duke Energy the annual probability of Jocassee Dam failing is four times less than the odds of being dealt a royal flush. In 2010 scientists at the NRC estimated the annual failure probability of the Lake Jocassee dam to be 2.8E-4/yr, which is about the odds of being dealt a straight flush and is forty times more likely than the failure frequency used by Duke Energy. Thus, the risk at ONS is about 10 to 100 times greater than at a typical US reactor plant (emphasis added).

The NRC seems to have taken Duke’s word for it, again, and did not pursue additional action. Duke often notes, in these communications with the NRC, that the Jocassee Dam is periodically inspected, continuously manned, and instrumented. However, the dam cannot be continuously manned in extreme flood conditions.

It is important to remember that there are always two components to risk: frequency and severity. In that equation, even if the anticipated frequency of an event is so low that it approaches “never” for an event so severe – for example, an event that causes widespread, deadly, permanent radioactive contamination following a nuclear meltdown – overall risk becomes sufficiently appreciable to warrant preventive action.

According to a Memo to File prepared by a senior project manager at NRC’s Region II division of licensing, dated March 19, 2013, NRC staff had prepared another evaluation in August 2009 that accepted timelines for the installation of permanent modifications to protect against external flooding from dam failure at Oconee. It says the following:

The ground elevation at the SSF is 796.0 feet above mean sea level (msl). The SSF flood protection extends to 7.5 feet above the ground elevation. The predicted water height at the SSF in the new inundation study was 815.0 feet above msl, 11.5 feet higher than the flood protection for the SSF. The licensee is developing permanent plant modifications in accordance with the CAL, and, so far, has installed one permanent flood structure, a swale wall near the visitor’s center, and one temporary flood structure, a wall at the intake dike.

A colleague of Criscione’s, Jeffrey Mitman, also a reliability and risk analyst at NRC, claims that if Jocassee Dam were to fail, ONS operators could expect to see a flood height of 19 feet. However, he notes, the wall Duke has installed to protect the SSF is only 7.5 feet high, and additional flood protection is needed. The NRC has redacted “19 feet” in all of his communications and has redacted all references to all flood height elevations in all documents related to flooding at Oconee from upstream dam failure, citing national security reasons. As with those of Criscione and Perkins, Mitman’s admonitions have been ignored by the NRC, and the agency has isolated all three of them from workplace debate and decision-making regarding the flooding risk at ONS and other vulnerable plants.

Climate Change is Increasing the Flooding Risk at Oconee Nuclear Station
As the world warms, more water evaporates from the Earth’s surface into the atmosphere, water that is converted to precipitation; more water means more storms in the Southeastern US. According to the EPA, “the amount of precipitation during heavy rainstorms has increased by 27 percent since 1958 in the Southeast, and the trend toward increasingly heavy rainstorms is likely to continue.” In South Carolina, there are nearly 210,000 people living in areas at an elevated risk of inland flooding.

In October 2015 South Carolina received unprecedented rainfall – over 20 inches across the state – and severe flooding. The storm came from an upper atmospheric low-pressure system that funneled tropical moisture from Hurricane Joaquin. According to a report by the Federal Emergency Management Agency, “From October 1 through 5, 2015, heavy rainfall over parts of South Carolina resulted in the failure of 49 state regulated dams, one federally regulated dam, two sections of the levee adjacent to the Columbia Canal, and many unregulated dams. Many one-story homes were submerged in these rains. A major disaster declaration was issued for the State of South Carolina on October 5, 2015, for dozens of counties. While Oconee County was not one of them, the adjacent counties Greenville, Greenwood, and Spartanburg were; the heavy rains could just as easily have devastated Oconee County as they did areas close by – it is just possible that the Oconee Nuclear Station dodged a bullet in 2015.

Heavy rains came to South Carolina again in 2016, and again, there was a significant number of dam failures. According to one account in a local newspaper:  “A year-long effort to dramatically upgrade South Carolina’s beleaguered dam safety program didn’t prevent at least 25 dams from failing during Hurricane Matthew last weekend.” The dams, almost all in eastern South Carolina, cracked and ruptured as drenching rains pounded down, causing rivers, creeks and ponds to spill over their banks. Once again, in 2016 all of the counties adjacent to Oconee received federal disaster assistance. And once again, the dams at Jocasee and Keowee, and Oconee Nuclear Station, dodged a bullet. It could just as well have been the case that extreme precipitation and flooding was just enough to knock out the Jocassee Dam, flood Oconee Nuclear Station, cause a full-Fukushima-meltdown, and render an entire region downstream of the facility, including the entire Clemson University campus and the towns of Clemson, Pickens, Seneca, and so many others, permanently uninhabitable. This is a nightmare scenario, and one that the NRC needs to address more honestly and more realistically if the public is to be protected.

According to FEMA, thousands of dams in the US are categorized as “High-Hazard Potential Dams” that could fail and result in loss of life and extensive property damage.

Poker as a Way of Understanding the Probability of a Disaster
The NRC requires nuclear power plants to be protected against “credible” events. “Credible” is nowhere defined, but generally the NRC has accepted events with an annual frequency of less than one in a million (1E-6/yr in scientific nomenclature) as not being credible, and anything over that as being credible.

NRC scientists have calculated the annual failure probability of the Jocassee Dam to be approximately 2.8E-4/year (or 0.00028). That translates to a failure probability of about one in 3,600. The chance that a poker player will be dealt a hand with four-of-a-kind is 2.56E-4, or 0.000256. So, the chance that the Jocassee Dam will fail in any one year is slightly higher than being dealt a poker hand with four-of-a-kind. Duke Energy has come up with a different probability of dam failure: 7E-6/yr (or 0.000007), which is about the same chance of being dealt a royal flush, the best possible poker hand. The method the NRC used to arrive at its estimate is detailed in a publicly available study, the method Duke Energy used is unpublished.

Criscione argues that a better way to understand the risk of dam failure is to integrate the annual probability over time. If we assume that the reactors at Oconee Nuclear Station will operate for another twenty years and that the NRC’s failure rate estimate is accurate, there is a 0.56 percent chance that the dam will fail at some point within the next 20 years, according to Criscione. We argue that it should not be up to the NRC alone to determine what is an acceptable level of risk and what is not: the public at large, especially including everyone living within a large radius of ONS, should have a say.

Privatized Profit, Socialized Risk
The Oconee Nuclear Station – Jocassee Dam flooding risk issue is a classic example of privatizing the profits and socializing the risk. The consequences of a failure of the Lake Jocassee Dam are huge: a potential Fukushima-style nuclear accident outside of Clemson, SC that could require the permanent evacuation of people from large parts of the southeast. Yet, the risk of it occurring are so small, that from a business perspective it is taken as acceptable. The thinking is that there is a 99.44 percent chance that the reactors at Oconee will not be inundated following dam failure, so why spend millions of dollars addressing the flooding concerns? And, in the unlikely event of a dam failure, no one from Duke Energy will go to jail or even pay a fine; all nuclear power plants carry steep insurance policies, and Congress will provide federal disaster assistance funding. Although it is possible that Duke Energy would go bankrupt, the brunt of the cost would fall onto the taxpayer. So, by avoiding the steep cost of adequately protecting against dam failure, Duke Energy protects its profit margin, which benefits its employees and shareholders, but places the cost of a low-probability, high-severity event squarely on the shoulders of the American people.

Security Concerns
Criscione objects vehemently to the secrecy and says the lack of transparency has allowed the NRC to ignore the problem. “The information being withheld has nothing to do with security procedures, design basis threats, or any other detailed information that might be of use to a saboteur,” he claims. It is true that human sabotage has not yet caused a dam to fail, but thousands of dams have failed due to the forces of nature.

Since 2007 the NRC has been systematically withholding information on dam failures under the guise of security concerns—even though none of the documents discuss security threats. The documents of concern all discuss flooding due to dam failures caused by extreme weather events, earthquakes, latent design and construction failures, etc. Insider sabotage or hostile terrorist action is never discussed. Why? Because security concerns are completely separate in that the solutions are separate.

The solution to terrorist action is to guard the dam from the assumed terrorist threat (called the Design Basis Threat or DBT in NRC jargon). The solution to internal sabotage is a rigorous access program to evaluate personnel being granted unescorted access to the facility (e.g. the workers who operate the dam and the contractors who repair broken equipment). Whether or not a facility (such as a dam) is adequately guarded is a matter addressed by security specialists and not by scientists with doctoral degrees in hydrology, seismology or civil engineering.

The solution to extreme weather events, seismic events, and design or construction flaws is to evaluate whether or not such issues are credible and, if so, whether or not the downstream nuclear reactors are adequately guarded from the postulated flood heights. This involves expertise in meteorology, hydrology, civil engineering, etc. It is not the realm of security analysts.

Unfortunately, due to supposed security concerns regarding the dams, the NRC has been withholding all flooding issues associated with dams and preventing an open public discussion of whether or not downstream nuclear plants are adequately protected; even when the discussion solely involves “acts of nature” and contain no discussion of hostile actions and their prevention.

Although most people at the NRC, at the nuclear utilities that operate reactors, and at the non-government organizations (NGOs) that oppose nuclear power all agree that details of the security measures in place to protect dams should not be released to the public, that is not where the NRC draws the line. It has been drawing the line at the details of the consequences of a dam failure. But those consequences are the same whether due to terrorist action or due to acts of nature. The result is the public is not made aware of the true risk which it is facing regarding flooding nuclear reactor plants.

In October 2012 Criscione wrote a letter to Senator Joseph Lieberman who, at the time, was the Chairman of the Senate Committee on Homeland Security and Governmental Affairs. In that letter Criscione expressed his concern that, since the NRC has no authority to regulate dam, no federal agency was ensuring that the guard force at the Lake Jocassee Dam was adequate to repel the design basis threat that the NRC assumes for its reactor plants. Criscione’s concern was that since the dam is regulated by FERC and the downstream reactors were regulated by NRC and that since FERC and NRC have different security standards, a coordinated government effort led by an agency like the Department of Homeland Security was necessary to ensure that dams upstream of nuclear reactors were adequately guarded. Senator Lieberman forwarded Criscione’s letter to Hubert Bell, the NRC’s Inspector General who rolled those concerns into its ongoing investigation of Criscione’s September 18, 2012 letter to the NRC Chairman.

To this day, the NRC has not conducted any investigation into whether or not the Lake Jocassee Dam is adequately guarded, nor has the NRC reviewed any such study performed by any other government agency. Apparently, all the NRC has done to address the issue is to broadly redact from public discussion all details of the consequence of dam failures upstream of nuclear reactor plants in the hopes that terrorists will not recognize the vulnerability posed to these plants.

Criscione’s Life as a Whistleblower: Instead of Being Rewarded, He is Retaliated Against
All throughout 2011 and 2012, Criscione and several of his colleagues became increasingly alarmed at the way the NRC was mishandling the threat of flooding from an upstream dam failure. Criscione’s concerns also became increasingly focused on the situation at the Oconee Nuclear Station in South Carolina. He was familiar with the Screening Report written by Richard Perkins and was aware that dam failures from the stresses imposed by nature are routine: earthquakes, tornados, storms, hurricanes, and the massive rainfall and flooding that is often associated, applies power that typically dwarfs that of human meddling.

Criscione’s primary concern was that within 10 hours of dam failure at Jocassee, there could be a meltdown forcing the evacuations of large population groups in North Carolina, South Carolina and Georgia. The consequences from the meltdowns could be more severe than from the Fukushima accident.

On September 18, 2012 Criscione submitted a 19-page disclosure to the NRC Chairman about his discovery of a serious failure to follow through on corrective action against a serious safety vulnerability at the Oconee Nuclear Station. In the email, he attached eight non-public reference documents, and copied the email to Members of Congress, about a dozen Congressional staffers, the Office of Special Counsel, 29 NRC staff, the NRC’s General Counsel, and the NRC Inspector General and his deputy. (He had assumed that since everyone to whom the email was sent was a federal government employee, all were authorized to receive non-public information.)

When the Commission did not act except to cite him for not marking the letter For Official Use Only, in October and November 2012 he wrote letters to the Senate Committee on Homeland Security and Government Affairs (see letter, .pdf) and the Senate Committee on the Environment and Public Works.

At some point following the September 18 email, a congressional staffer shared Criscione’s letter and the attached documents with Greenpeace; Jim Riccio at Greenpeace then facilitated media coverage, resulting in an expose published on October 19, 2012 in the Huffington post by Tom Zeller. (See Leaked Report Suggests Long-Known Flood Threat To Nuclear Plants, Safety Advocates Say, Huffington Post, October 19, 2012).

The letter to Members of Congress and the subsequent media coverage caught the attention of the NRC’s Inspector General, Hubert Bell.

On January 17, 2013, Criscione was interrogated by two armed agents from the IG office, William Walls and Daniel Esmond, and was told he was being investigated for commission of a federal felony. He was advised that he had the right to remain silent but was also cautioned: “Your silence may be considered by an administrative proceeding.” He was sworn under oath, asked many detailed questions about his communications with Members of Congress and other individuals and groups; the agents, as Criscione recalls, were intent on learning the identity of the Congressional staffer who had leaked the 2011 Screening Analysis Report to Greenpeace. The interrogation troubled Larry Criscione a great deal, partly because he was being pressured to provide detailed responses without accessing his files or notes. The agents never let Criscione know the status of the charges against him, and, to this day, Criscione maintains: “I have also never been told by anyone at NRC what – if anything – I did wrong.”

In February 2013, the Assistant US Attorney in Springfield, IL, from whom Hubert Bell’s agent sought an indictment, formally declined to prosecute, stating that no federal offense had been committed. However, no one at the AG’s office in Illinois or at NRC ever alerted Criscione that charges would not be filed; he had to learn this on his own, months later, using FOIA requests. The IG’s aggressive action towards Criscione was an overt attempt to silence him, period.

Conclusion
To this day, the NRC is continuing to downplay the risk of flooding at licensed nuclear power plants, engaging in fancy bureaucratic footwork designed to give the appearance that it is addressing the problem responsibly while giving entirely too much discretion to power plant owners and operators to deal with the problem however they choose, and keeping the public in the dark by systematically redacting critical information under the guise of questionable national security concerns. To this day, the agency is attempting to silence NRC employees who continue to sound the alarms and refuse to accept agency complacence. This is both unconscionable and unacceptable.

Anne Polansky, Senior Climate Policy Analyst for Government Accountability Project’s Climate Science & Policy Watch program, has over 30 years of experience in science-based public policymaking in the areas of climate change, renewable energy, and sustainability. She has held management positions with the House Committee on Science, Space and Technology and the Solar Energy Industries Association; and has provided specialized consulting services for a variety of non-profit organizations. Anne holds a MS degree from Clemson University and a BS degree from Vanderbilt University. 

This article was written with assistance from Lawrence Criscione, a Reliability and Risk Analyst with the Nuclear Regulatory Commission (NRC) since October 2009. He is an experienced engineer and licensed reactor operator; and spent five years in the Navy aboard the USS Georgia as a submarine warfare officer under Admiral Rickover. Criscione has BS in Chemistry from St. Louis University and a BS in Electrical Engineering from the University of Missouri at Rolla.