(b) Objective.

1. (1) A licensee's timely submission of suspicious activity reports (SARs) to Federal and local law enforcement agencies is an important part of the U.S. government's efforts to disrupt or dissuade malevolent acts against the nation's critical infrastructure. Despite the increasingly fluid and unpredictable nature of the threat environment, some elements of terrorist tactics, techniques, and procedures remain constant. For example, attack planning and preparation generally proceed through several predictable stages, including intelligence gathering and preattack surveillance or reconnaissance. These preattack stages, in particular, offer law enforcement and security personnel a significant opportunity to identify and disrupt or dissuade acts of terrorism before they occur. However, to use this information most effectively, timely reporting of suspicious activities by licensees to both Federal and local law enforcement is of vital importance.
2. (2) Licensee's timely submission of SARs to the NRC supports one of the agency's primary mission essential functions of threat assessment for licensed facilities, materials, and shipping activities.

(c) General requirements.

1. (1)

   1. (i) Licensees subject to paragraphs (d), (e), and (f) of this section must report suspicious activities that are applicable to their facility, material, or shipping activity.
   2. (ii) If a suspicious activity requires a physical security event notification pursuant to § 73.1200, then the licensee is not required to also report the occurrence as a suspicious activity pursuant to this section.
   3. (iii) If a suspicious activity report results in a LLEA response the licensee must notify the NRC in accordance with the requirements of § 73.1200.

2. (2)

   1. (i) Licensees must promptly assess whether an activity is suspicious. Licensees may review additional information as part of an assessment process, including interactions with their LLEA. However, such assessments and any subsequent reporting must be completed as soon as possible, but within 4 hours of the time of discovery. The licensee must base its assessment upon its best available information on the activity, which may include its knowledge of its locale and the local population.
   2. (ii) The licensee's assessment of a potential suspicious activity, and any discussion of this activity with its LLEA, does not constitute a conclusion, in and of itself, that the activity is suspicious.
   3. (iii) Licensees are not required to report activities that, based on their assessment, appear to be innocent or innocuous.

3. (3) For a suspicious activity specified under paragraph (d) of this section, the licensee must make the following reports:

   1. (i) First, to their LLEA;
   2. (ii) Second, to their applicable FBI local field office;
   3. (iii) Third, to the NRC Headquarters Operations Center; and
   4. (iv) Lastly, to the local FAA control tower if the suspicious activity involves aircraft overflights in proximity to the licensee's facility.

4. (4) For a suspicious activity specified under paragraphs (e) and (f) of this section, the licensee or its designated movement control center must make the following reports, in the order indicated:

   1. (i) First, to the applicable LLEA;
   2. (ii) Second, to the applicable FBI local field office; and
   3. (iii) Lastly, to the NRC Headquarters Operations Center.
   4. (iv) For licensees making such reports related to shipping activities, the licensee responsible for the security of the shipment must contact the applicable FBI local field office.
   5. (v) For a movement control center making such reports related to shipping activities, the applicable FBI local field office is as requested by the FBI. As such, the FBI may direct the use of the FBI local field office applicable to the movement control center itself or to the FBI local field office applicable to the licensee responsible for the security of the shipment.

5. (5)

   1. (i) Licensees subject to paragraphs (d) and (f) of this section must establish a point of contact with their local FBI field office.
   2. (ii) Licensees subject to paragraph (d) of this section must establish a point of contact with their local FAA control tower.

6. (6)

   1. (i) For licensees subject to paragraph (e) of this section who are responsible for the security of the shipment(s), the licensee must establish a point of contact with their local FBI field office.
   2. (ii) For licensees subject to paragraph (e) of this section who are employing the services of a movement control center, the movement control center must establish a point of contact with its local FBI field office.
7. (7) Licensees and movement control centers reporting suspicious activities to the NRC must notify the NRC Headquarters Operations Center via the telephone number specified in Table 1 of appendix A of this part.

8. (8)

   1. (i) Licensees and movement control centers reporting suspicious activities must document the LLEA and FBI points of contact in written security communication procedures or route approvals, as applicable.
   2. (ii) Licensees reporting suspicious aircraft overflight activities must document the FAA point of contact in written communication procedures.

(d) Suspicious activities—facilities and materials.

1. (1) For licensees subject to the provisions of § 73.20, § 73.45, § 73.46, § 73.50, § 73.51, § 73.55, § 73.60, or § 73.67, the licensees must report activities they assess are suspicious. Examples include, but are not limited to, the following:

   1. (i) Challenges to the licensee's security systems and procedures;
   2. (ii) Elicitation of non-public information from knowledgeable licensee or contractor personnel regarding the licensee's security or emergency response programs;
   3. (iii) Observed surveillance or reconnaissance activity from within posted or restricted areas (i.e., non-public areas), including surface activity, underwater activity, manned aerial activity, and unmanned aerial activity;
   4. (iv) Observed surveillance activity from public spaces outside of the licensee's control; or
   5. (v) Unauthorized aircraft activities in close proximity to the facility (i.e., above or near), involving either manned or unmanned aircraft, operating in a manner potentially indicative of surveillance or reconnaissance activity.

2. (2) As an exemption, this paragraph does not apply to:

   1. (i) Licensees who are subject to the provisions of § 73.67, and who are also engaged in the enrichment of special nuclear material using Restricted Data (RD) information, technology, or materials.
   2. (ii) Licensees who are subject to the provisions of § 73.67 of this part, and who are also engaged in the fabrication of new fuel assemblies.
3. (3) Licensees are not required to report commercial or military aircraft activity that is assessed as routine or non-threatening.

(e) Suspicious activity—shipping activities.

1. (1) For licensees subject to the provisions of § 73.20, § 73.25, § 73.26, § 73.27, or § 73.37, the licensee must report activities they assess are suspicious. Examples include, but are not limited to, the following:

   1. (i) Challenges to the licensee's or its transportation contractor's communications subsystems regarding the transport system;
   2. (ii) Challenges to the licensee's or its transportation contractor's security subsystems for the transport system;
   3. (iii) Interference with or harassment of in-progress shipments;
   4. (iv) Elicitation of non-public information from knowledgeable licensee personnel or the licensee's transportation contractor personnel regarding transportation program elements, including: security programs, operations programs, communication protocols, shipment routes, safe haven locations, and emergency response programs; or
   5. (v) Observed surveillance or reconnaissance activity of ongoing shipments.
2. (2) For licensees using a movement control center for shipments of radioactive material or special nuclear material (SNM), the movement control center may report suspicious activities to LLEA, the FBI, and the NRC, in lieu of the licensee making such reports.

(f) Suspicious activities—enrichment facilities.

1. (1) For licensees subject to the provisions of § 73.67, who are also engaged in the enrichment of SNM using RD information, technology, or materials; the licensee must report activities they assess are suspicious. Examples include, but are not limited to, the following:

   1. (i) Aggressive noncompliance by visitors to the licensee's facility involving willful unauthorized departure from a tour group or willful unauthorized entry into restricted areas;
   2. (ii) Unauthorized recording or imaging of sensitive technology, equipment, or materials; or
   3. (iii) Elicitation of non-public information from knowledgeable licensee or contractor personnel regarding physical or information security programs intended to protect RD information, technology, or materials.

2. (2)

   1. (i) Licensees must report, in accordance with § 95.57 of this chapter, alleged or suspected activities involving actual, attempted, or conspiracies to obtain RD, communicate RD, remove RD, or disclose RD in potential violation of Sections 224, 225, 226, and 227 of the Atomic Energy Act of 1954, as amended (42 U.S.C. 2274, 2275, 2276, and 2277).
   2. (ii) As an exemption, the licensee is not required to also report such actual, attempted, or conspiracies to obtain RD, communicate RD, remove RD, or disclose RD as suspicious activities pursuant to this section.

(g) Suspicious activities—exemptions.

1. (1) Licensees subject to § 73.67 who possess strategic special nuclear material in quantities greater than 15 grams but less than the quantity necessary to form a critical mass, as specified in § 150.11(a) of this chapter, are exempt from the provisions of this section.

2. (2) The following licensees are exempt from the provisions of this section:

   1. (i) Docket number 70-7020; and
   2. (ii) Docket number 70-7028.