The NRC is Regulating Nuclear Security like it’s September 10, 2001—And We Should All Be Concerned

The Nuclear Regulatory Commission is rolling back security rules put in place after the September 11 attacks, according to a longtime nuclear safety analyst. After 9/11, Congress required the NRC to run its own mock attack drills at power plants every three years — tests where security teams defend against simulated terrorists trying to trigger a meltdown. Those drills, called force-on-force inspections, showed real weaknesses over the years and pushed plants to improve.

Starting in 2028, the NRC plans to let plant owners run and grade these drills themselves, with the agency only observing. The commission has also cut routine security and cybersecurity inspection resources by more than half in some cases, shifted inspection duties to staff without security training, allowed some new reactor owners to rely on local police instead of their own security forces, and eliminated the office created after 9/11 to oversee nuclear security. A newly proposed rule would also redefine what counts as a security failure, so that even an attack causing a meltdown as severe as Three Mile Island might not officially count as "radiological sabotage" if public radiation exposure stayed under certain limits.

None of this requires homeowners to do anything, but it matters if you live near a nuclear plant or if new small reactors get built in more populated areas, as the industry is now planning. Weaker independent testing and oversight mean less outside verification that a plant's security force could actually stop a real attack, at a time when threats like drones and AI-assisted cyberattacks are becoming more sophisticated.