Public Citizen v. Nuclear Regulatory Commission

573 F.3d 916 (2009) PUBLIC CITIZEN; San Luis Obispo Mothers for Peace, Petitioners, v. NUCLEAR REGULATORY COMMISSION, Respondent. State of New York, Petitioner, v. Nuclear Regulatory Commission; United States of America, Respondents. Nos. 07-71868, 07-72555. United States Court of Appeals, Ninth Circuit. Argued and Submitted November 17, 2008. Filed July 24, 2009. *917 Adina H. Rosenbaum, Public Citizen Litigation Group, Washington, D.C., for the petitioners. John J. Sipos, Assistant Attorney General, Albany, NY, for the petitioner. Steven F. Crockett, Special Counsel, Karen D. Cyr, General Counsel, John F. Cordes, Jr., Solicitor, and E. Leo Slaggie, Deputy Solicitor, United States Nuclear Regulatory Commission, Washington, D.C.; Ronald J. Tenpas, Assistant Attorney General, Ronald M. Spritzer, Environment and Natural Resources Division, United States Department of Justice, Washington, D.C., for the respondents. David A. Repka, Winston & Strawn, Washington, D.C., for the intervenor-respondent. Brian Hembacher, Deputy Attorney General, State of California, Los Angeles, CA, for the amici curiae. Before: CYNTHIA HOLCOMB HALL, THOMAS G. NELSON and SIDNEY R. THOMAS, Circuit Judges. Partial Concurrence and Partial Dissent by Judge THOMAS. HALL, Senior Circuit Judge: Petitioners Public Citizen, Inc., San Luis Obispo Mothers For Peace, the State of New York,[1] and amicus State of California ("Petitioners") challenge the Nuclear Regulatory Commission's ("NRC" or "Commission") modification of the Design Basis Threat ("DBT") rule and partial denial of the Committee to Bridge the Gap's ("CBG") petition for rulemaking. Petitioners claim the Commission acted arbitrarily *918 and capriciously and contrary to law by refusing to include the threat of air attacks in the final revised DBT rule. Petitioners also claim NRC violated the National Environmental Policy Act ("NEPA") by not considering the risk of an airborne terrorist attack in its Environmental Assessment ("EA"), and that this risk creates a potentially significant impact on the environment necessitating a full Environmental Impact Statement ("EIS"). We deny the petition. I. Background A. The History of the Commission and Development of the "Adequate Protection" Standard To better understand the complicated history of the DBT Rule, we first outline the role of the NRC itself. In 1954, Congress passed the Atomic Energy Act ("Act"). 42 U.S.C. § 2011 et seq. The Act created the Atomic Energy Commission, later renamed the Nuclear Regulatory Commission, to regulate and develop the use of atomic energy. The Act is "virtually unique in the degree to which broad responsibility is reposed in the administrative agency, free of close prescription in its charter as to how it shall proceed in achieving the statutory objectives." Siegel v. Atomic Energy Commission, 400 F.2d 778, 783 (D.C.Cir.1968). When licensing nuclear facilities, the Commission is charged with ensuring that the operation of those facilities is "in accord with the common defense and security and will provide adequate protection to the health and safety of the public." 42 U.S.C. § 2232(a). Although "adequate protection" is not defined in the statute, legislative history "indicate[s] that the Congressional concern with the common defense and security related to such matters as the safeguarding of special nuclear material; the absence of foreign control over the applicant; the protection of Restricted Data; and the availability of special nuclear material for defense needs." Siegel, 400 F.2d at 781 (internal quotations omitted). "The public health and safety standard, in like fashion, was said to be addressed to the overall qualifications of the applicant and the design of the facility to protect plant employees and the public against accidents and their consequences." Id. at 781-782(internal quotations omitted). The adequate protection standard has also acquired meaning through subsequent case law. Union of Concerned Scientists v. NRC, 824 F.2d 108, 117 (D.C.Cir.1987) (Concerned Scientists I), held that while the Commission could not consider costs in determining the level of adequate protection necessary, it could consider other factors, including the nature and extent of the risks involved. The court declined to establish the scope of those factors, however, instead concluding that "the `adequate protection' standard may be given content through case-by-case application of [the Commission's] technical judgment rather than by a mechanical verbal formula or set of objective standards" set by either NRC or an interpreting court. Union of Concerned Scientists v. NRC, 880 F.2d 552, 558 (D.C.Cir.1989) (Concerned Scientists II). Concerned Scientists I also made clear that "adequate protection" does not mean "absolute protection," and that the standard "permits the acceptance of some level of risk." 824 F.2d at 114, 118. "Safe is not the equivalent of risk-free." Id. at 118 (internal quotations omitted). The Commission is authorized to impose additional safety measures on licensees above those required by adequate protection, and in doing so may consider the economic costs of those extra measures. Id. Siegel v. Atomic Energy Commission was the first case to challenge whether adequate protection should extend beyond the original congressional *919 concerns to also encompass "the risk of an enemy attack or sabotage against [the] structures." 400 F.2d at 783-784. The Siegel court held that there was no indication that the "Commission was commanded to intrude the possibility of enemy action into the concepts of `the common defense and security' and `the public health and safety.'" Id. The Siegel case dealt with the Commission's decision declining to require licensees to protect against possible missile attacks on nuclear facilities near Cuba. The court upheld the Commission's newly created "Enemy of the State" rule, which insulated licensees from the requirement that they protect against the effects of attacks or destructive acts by enemies of the United States (foreign governments or other persons) or that they use or deploy weapons incident to U.S. defense activities. 10 C.F.R. § 50.13. The court favorably cited the Commission's rationale animating the Enemy of the State rule: "that [requiring] reactor design features to protect against the full range of the modern arsenal of weapons [is] simply not practicable and that the defense and internal security capabilities of this country constitute, of necessity, the basic `safeguards' as respects possible hostile acts by an enemy of the United States .... [t]he risk of an enemy attack or sabotage against such structures, like the risk of all other hostile attacks which might be directed against this country, is a risk that is shared by the nation as a whole." Id. at 783. B. The Origin of the Design Basis Threat Rule The Commission, wholly of its own accord, decided in 1977 to promulgate the first Design Basis Threat ("DBT") rule to protect nuclear power reactors from industrial sabotage. 42 Fed.Reg. 10,836 (Feb. 24, 1977). "Design bases" are, generally speaking, applicant or licensee information which identifies the specific functions to be performed by a structure or system. 10 C.F.R. § 50.2. The "threat" is an adversary characteristic, or what sort of threat against which a licensee should be prepared to defend and engage. 72 Fed.Reg. 12,705, 12,705, 708 (Mar. 19, 2007). The DBT rule challenged in this action, 10 C.F.R. § 73.1, is the purpose and scope section which defines included adversary characteristics. Other regulations implement specific physical protection requirements to address these adversary characteristics once they are included within the scope of the rule. See, e.g., 10 C.F.R. § 73.55(outlining physical protection requirements to protect against radiological sabotage). The regulation initially protected only against industrial sabotage by individuals and groups with possible inside information and hand-held weapons. But, the regulation stated: "[t]he kind and degree of threat and the vulnerabilities to such threats will continue to be reviewed by the Commission.... the Commission [will] consider changes to meet the changed conditions." 42 Fed.Reg. 10,836, 10,836. In 1994, the Commission revised the DBT rule in response to an intrusion at a nuclear power plant, the 1993 vehicle bomb attack on the World Trade Center, and intelligence that showed "a conspiracy with ties to the Middle East extremists clearly demonstrated the capability and motivation to organize, plan, and successfully conduct a major vehicle bomb attack," 59 Fed. Reg. 38,889, 38,891 (Aug. 1, 1994). The revised DBT incorporated the threat of adversaries utilizing "a four-wheel drive land vehicle used for transporting personnel and their hand-carried equipment," and "a four-wheel drive land vehicle bomb." Id. The Commission explicitly denied that these changes were necessary to meet the adequate protection standard. Instead, the changes were issued under *920 the Commission's authority to outline additional safety measures as a "matter of prudence" and represented a "substantial increase in protection of the public health and safety." 59 Fed.Reg. 38,889, 38,891, 896; see also Concerned Scientists I, 824 F.2d at 118. To partially implement the 1994 DBT change, the Commission also revised 10 C.F.R. § 73.55 to require the installation of passive vehicle barriers. These barriers were required to "protect against vehicle intrusion into protected areas," but the Commission believed that, if placed in the correct locations, they could also protect against a vehicle bomb. 59 Fed.Reg. 38,889, 38,891. Because the changes were permissibly made to "provide an additional, substantial increase in the overall protection of the public health and safety," rather than statutorily required to meet the adequate protection standard, the Commission engaged in a cost-benefit analysis of the protective measures. Id.; see also Concerned Scientists I, 824 F.2d at 118. In that cost-benefit analysis, the Commission explicitly rejected the argument from the nuclear industry that the Enemy of the State rule insulated them from these measures. The Commission reasoned "[t]here is a significant difference in the practicality of defending against a missile attack and constructing a vehicle barrier," and that the scope of the Enemy of the State rule was to "relieve applicants of the need to provide protective measures that are the assigned responsibility of the nation's defense establishment." 59 Fed. Reg. 38,889, 38,893. The Commission further explained that the Enemy of the State rule "recogniz[es] that it [is] not practical for the licensees of civilian nuclear power reactors to provide design features that could protect against the full range of the modern arsenal of weapons." Id. C. Post 9/11 and the Commission's Response Following 9/11, the Commission again determined a change to the DBT rule was necessary. Many studies were conducted by both private and government entities, independently and at the behest of the NRC, which showed that nuclear facilities were not designed to withstand the impact of a commercial jet plane. The studies showed that while "many of [the] safety-related systems are well protected within hardened structures ... some are not." In the worst case, an aircraft crash had the potential to set off an accident sequence resulting in "serious damage if not total meltdown" of the core, but such a sequence would "require[] the occurrence of multiple failures, many of which are strongly plant-dependent." Additionally, many intelligence agencies, and the NRC itself, closely monitored and acknowledged the credible threat of a terrorist attack on nuclear facilities. The Commission responded to this information by issuing emergency orders to licensees on February 25, 2002, January 7, 2003, and April 29, 2003. These orders, though non-public and protected as "safeguards information" pursuant to 42 U.S.C. §§ 2167, 2201(i), required licensees to make a wide variety of security improvements. See 70 Fed.Reg. 67,380, 67,381 (Nov. 7, 2005). Following the implementation of these orders, the NRC "conducted detailed, site-specific engineering studies of a limited number of plants to gain insights on [continued] potential vulnerabilities of nuclear power plants to deliberate attacks involving large commercial aircraft." 72 Fed.Reg. 12,705, 12,710. For the NRC, these studies "confirmed the effectiveness of the February 2002 NRC-ordered mitigative measures" and "the low likelihood of both damaging the reactor core and releasing radioactivity that could affect public health and safety." Id. The *921 studies also "indicate[d] that there would be time to implement the required onsite mitigating actions" in the "unlikely event" that a terrorist is able to use a large aircraft against a nuclear facility. Id. "[A]dditional key radiological protection and mitigation strategies" were imposed by the NRC on appropriate licensees by order in June 2006. Id.; see also 71 Fed. Reg. 36,554 (June 27, 2006). The NRC also increased coordination efforts with other government agencies. "[I]n early March 2006, the NRC hosted an Interagency Aircraft Attack Tabletop Exercise at NRC Headquarters .... reconfirm[ing] the respective responsibilities of the participating organizations (NRC, DHS [Department of Homeland Security], DOD [Department of Defense], and FBI) in the event of a nuclear plant aircraft attack and clarif[ying] protocols for response-related interagency communication and coordination." 72 Fed.Reg. 12,705, 12,710. The NRC and DHS also "worked together to develop and improve EP [Emergency Planning] for a terrorist attack through federal initiatives such as comprehensive review programs and integrated response planning efforts" including "State/local/tribal response capabilities." 72 Fed.Reg. 12,705, 12,712. Those efforts "include[d] prearranged plans with local law enforcement and emergency planning coordination." 72 Fed.Reg. 12,705, 12,714. In June 2004, the Commission announced a proposed amendment to the DBT rule "to incorporate the Commission actions taken as a result of September 11, 2001," making "review and revisions as appropriate." 69 Fed.Reg. 38,635, 38,636 (June 28, 2004). In July 2004, the Commission received a rulemaking petition from Committee to Bridge the Gap, PRM-73-12, which requested, inter alia: amending the DBT to "encompass attacking forces equal to those of 9/11" including attacks by boat and by air; amending the DBT enabling regulations to mandate security plans, systems, inspections, and force-on-force exercises; and requiring construction of "beamhenge" shields[2] to protect against air attack.[3] Finally, as part of the Energy Policy Act of 2005, Congress directed the Commission to initiate or complete rulemaking to revise the design basis threats. 42 U.S.C. § 2210e (effective August 8, 2005). Congress directed the Commission to consider twelve non-exclusive factors in its rulemaking, including "the potential for water-based and air-based threats." § 2210e(b)(6).[4] *922 D. The Current Revised DBT Rule The Commission issued the final revised DBT rule in March 2007. See 72 Fed.Reg. 12,705. The rule significantly increased the range of threats included within the DBT scope and incorporated most of the factors Congress listed in § 2210e, including attacks by multiple groups attacking through multiple entry points, individuals willing to kill or be killed, water vehicles and water-based vehicle bomb assaults, and cyber attacks. See 10 C.F.R. § 73.1. The final rule discusses: the 2002 and 2003 Orders in general terms, actions taken by other Federal agencies in the wake of 9/11 to increase national security and NRC's efforts to coordinate responses with these agencies, each of the twelve congressional concerns, public comments received, and the CBG petition. See generally 72 Fed. Reg. 12,705. The revised DBT rule elaborates on the purpose and scope of the DBT rule, which the Commission explained was premised upon "adversary characteristics against which a private security force can reasonably be expected to defend." 72 Fed.Reg. 12,705, 12,713. Relying on this "reasonable expectation" standard, the Commission determined that the threat of an air-based attack was beyond the scope of the DBT rule. The Commission reasoned that "the responsibility for actively protecting against the threat lies with other organizations of the Federal government, as it does for any U.S. commercial infrastructures." 72 Fed.Reg. 12,705, 12,710 (emphasis added). The Commission explained that the public health and safety was adequately protected, however, because of: 1) the active protection of other Federal agencies, with whom the NRC continues to coordinate; and 2) mitigative measures implemented by the licensees that would limit the effect of an aircraft strike. 72 Fed. Reg. 12,705, 12,711. Because the NRC determined both that air-based threats were beyond the scope of the DBT rule and that the adequate protection standard was satisfied, CBG's petition for rulemaking, as it pertained to the beamhenge concept, was denied. Id.[5] As in 1994, the Commission again rejected the argument that the Enemy of the State rule insulated the industry from meeting the requirements of the revised DBT rule. The Commission emphasized that "the DBT rule does not focus on the identity, sponsorship, or nationality of the adversaries," but rather a "range of attacks and capabilities" against which private facilities can be "reasonably expected to defend ... regardless of whether it would or would not be deemed an `enemy of the state.'" 72 Fed.Reg. 12,705, 12,714-715. *923 To comply with NEPA, the Commission completed an EA for the final rule. Based upon the EA, the Commission concluded that there would be no significant environmental impact associated with the rule and therefore no EIS was necessary. 72 Fed. Reg. 12,705, 12,718. The Commission also concluded that NEPA did not require an evaluation of terrorist attacks as "the consequences of a terrorist attack cannot be said to be `an effect' of this rule, and analyzing the effects of a terrorist attack would be speculative at best." 72 Fed. Reg. 12,705, 12,718-719. The Commission acknowledged this court's decision in Mothers for Peace, but distinguished a licensing decision from the rulemaking action at issue. Id.; see Mothers for Peace v. NRC, 449 F.3d 1016 (9th Cir.2006). II. Standard of Review Under the Administrative Procedure Act ("APA"), agency decisions may be set aside only if "arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law." Earth Island Inst. v. U.S. Forest Serv., 442 F.3d 1147, 1156 (9th Cir.2006) (quoting 5 U.S.C. § 706(2)(A)). "Review under this standard is narrow, and the reviewing court may not substitute its judgment for that of the agency." Id. at 1156. "We reverse under the arbitrary and capricious standard only if the agency has relied on factors that Congress has not intended it to consider, has entirely failed to consider an important aspect of the problem, or has offered an explanation for that decision that runs counter to the evidence before the agency or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise." Id. "[A]n agency's interpretation of its own regulations is `controlling' unless `plainly erroneous' or inconsistent with `the regulations being interpreted.'" Long Island Care at Home, Ltd. v. Coke, 551 U.S. 158, 127 S.Ct. 2339, 2349, 168 L.Ed.2d 54 (2007) (citing Bowles v. Seminole Rock & Sand Co., 325 U.S. 410, 414, 65 S.Ct. 1215, 89 L.Ed. 1700 (1945)). This court is limited to a review of the reasoning the agency relied upon in making its decision. Safe Air for Everyone v. EPA, 488 F.3d 1088, 1091 (9th Cir.2007) (citing SEC v. Chenery Corp., 318 U.S. 80, 87, 63 S.Ct. 454, 87 L.Ed. 626 (1943)). "We will, however, uphold a decision of less than ideal clarity if the agency's path may reasonably be discerned." Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43, 103 S.Ct. 2856, 77 L.Ed.2d 443 (1983). "Where ... the agency's course of action indicates that the interpretation of its own regulation reflects its considered views [rather than merely post hoc rationalization] ... we have accepted that interpretation as the agency's own, even if the agency set those views forth in a legal brief." Coke, 127 S.Ct. at 2349; see also Global Crossing Telecomm., Inc. v. Metrophones, 550 U.S. 45, 127 S.Ct. 1513, 1525, 167 L.Ed.2d 422 (2007) (noting that even if agency action is inadequately reasoned initially, context and history of position can make agency's rationale obvious). III. Discussion A. The Scope of the DBT Rule and the Reasonable Expectation Standard Petitioners first argue that the Commission's explanation of the scope of the DBT rule—as reaching only those threats which a private force can reasonably be expected to defend against—is a new standard which conflicts with and departs from the Commission's prior interpretations of the DBT rule, and therefore represents an abuse of discretion. See, e.g., W. States Petroleum Ass'n v. EPA, 87 F.3d 280, 285(9th Cir.1996). Here, however, the Commission is not departing from an established standard, but is merely elaborating on the interpretation *924 of its own regulation. See Coke, 127 S.Ct. at 2349 (holding that so long as interpretive changes create no unfair surprise, as when an interpretation is codified in notice-and-comment rulemaking, the agency's interpretation of its own regulations is controlling unless plainly erroneous). Though the scope of the DBT has not previously been precisely defined,[6] the NRC's decisions have clearly been animated by considerations of the credibility of the threat at issue and whether private forces can reasonably be expected to actively engage that threat. This rationale, while not previously articulated in any one section of the rule, is easily ascertained from the history and context of the DBT rule. See Global Crossing, 127 S.Ct. at 1525. In both the 1977 and 1994 DBT rules, the Commission evaluated the "kind and degree of threat" at issue in determining the scope of the DBT, illustrating that a threat must be credible before it is included. See 42 Fed.Reg. 10,836, 10,836; see also 59 Fed.Reg. 38,889, 38,891. This is also consistent with NRC's decision to revise the DBT rule in light of the changed threat environment created by the events of 9/11. See 72 Fed.Reg. 12,705, 12,705. In rejecting the Enemy of the State rule in both its 1994 and 2007 revisions when it was "practical" or "reasonable" for private forces to defend against the included threats, the Commission illustrated that a concept of reasonableness animates both the DBT and the Enemy of the State rules. See 59 Fed.Reg. 38,889, 38,893; 72 Fed.Reg. 12,705, 12,714-715; see also Siegel v. Atomic Energy Commission, 400 F.2d 778, 783 (D.C.Cir.1968) (noting Commission's "recognition that reactor design features to protect against the full range of the modern arsenal of weapons are simply not practicable ...."). Both rules have also been influenced by the reasonable division of nuclear defense responsibilities between private and government forces. See Siegel, 400 F.2d at 783 (discussing defense and internal security capabilities in creation of Enemy of the State Rule); 59 Fed.Reg. 38,889, 38,893 (discussing that some protective measures are the assigned responsibility of the nation's defense establishment). Previous adversary characteristics have only been included within the scope of the DBT rule if they represented a class of threat that private forces could actively engage, such as militant individuals or vehicles. See 10 C.F.R. § 73.1. Only once a threat is determined to be within the scope of the DBT do the implementing regulations contemplate passive protective measures as supplemental means of defending against the threats. For instance, 10 C.F.R. § 73.55 required licensees to install passive barriers to protect against vehicle intrusion only after vehicle threats were added to the DBT rule. 59 Fed.Reg. 38,889, 38,891. The NRC determined however, that neither the inclusion of vehicle threats, nor the decision to locate barriers in a position where they could also maximize protection from vehicle bombs, was required to satisfy the statutory adequate protection standard. Instead, the Commission illustrated that the requirements of the DBT rule could exceed the requirements of adequate protection where the Commission determined that private forces could reasonably defend against the threat. Applying this standard of reasonable expectation, the agency did not act arbitrarily nor capriciously in concluding that air-based threats were beyond the scope of the DBT rule. An airplane attack is different in kind than attacks by militant *925 individuals or vehicles. Unlike other vehicles, airplanes are not used as an intrusionary device to gain access to secure portions of the facility. Instead, an airplane is used as an explosive weapon, more analogous to a missile. When facing an attack from a vehicle, a private force can engage those persons who seek to intrude upon the facility. There are no surviving crew members of an airplane for private forces to engage following impact. Like a missile, the only means of actively engaging an attack from an airplane is through the use of anti-aircraft devices (prudently) unavailable to private security forces. See 72 Fed.Reg. 12,705, 12,710. Thus the rationale of the Enemy of the State rule applies to air-based terrorist attacks, in that the defense against these attacks is best left to government agencies. Once the Commission made the general determination that air-based threats were outside the scope of the DBT, the Commission was under no obligation to consider passive protective measures, such as the beamhenge concept, as part of this rulemaking procedure.[7] B. Adequate Protection from Air-Based Threats Petitioners contend that the NRC's decision to define the scope of the DBT rule on what a private force can reasonably be expected to defend against, which excludes air-based threats, does not ensure adequate protection of the public health and safety. But, the Commission has an "overall statutory mandate to provide adequate protection to nuclear plants," which is not abdicated by its failure to fully protect against the threat of air-based attacks through an individual regulatory decision. Riverkeeper, Inc. v. Collins, 359 F.3d 156, 169 (2d Cir.2004). Here, while the NRC determined that air-based threats were beyond the scope of the DBT rule, the Commission provided two primary grounds to support its determination that adequate protection was met: 1) active protection against airborne threats by other Federal agencies, and 2) the ability of mitigative measures to limit the effects of an aircraft strike. 72 Fed.Reg. 12,705, 12,711. In its briefing, the NRC further explained that its judgment was also informed by: "threat analyses, by experience in the enforcement of DBT orders, by knowledge about the robustness of nuclear power plants, by a knowledge that nuclear power plants are better guarded than any other private critical infrastructure, and the guard forces subject to more oversight than any other civilian industry security force, by new studies of how plants might respond to an air crash, and by a knowledge of actions that other Federal agencies have taken since 2001 to protect against air threat." Brief for Respondents at p. 46(internal citations omitted). Though set forth in its briefing, this reasoning is consistent with the reasoning included in the Commission's final ruling and we accept it as the NRC's considered views. See Coke, 127 S.Ct. at 2349. Adequate protection may be given content through a case-by-case application of the Commission's technical judgment, including its knowledge of actions that other Federal agencies have taken since 2001 and its active coordination with many of those agencies. See Concerned Scientists II, 880 F.2d 552, 558 (D.C.Cir.1989).[8] *926 It is not implausible for the Commission to determine that most attacks will be prevented in the first instance by the coordinated efforts of multiple Federal agencies. It is also not implausible, based on the evidence before the Commission, for the NRC to conclude that, in the event that an airplane is able to strike a facility, the mitigative and protective measures imposed through the DBT Orders and the revised DBT would likely prevent any serious harm from occurring. The adequate protection standard need not prevent "each and every" potential attack, as advocated by amicus State of California, because the standard "permits the acceptance of some level of risk" and does not require "absolute protection." Concerned Scientists I, 824 F.2d 108, 114, 118 (D.C.Cir.1987). "[T]he NRC's considered conclusion— right or wrong—that [air-based threats were] being adequately addressed by other agencies of government and its consequent decision to leave the matter to those agencies cannot amount to an `abdication' of its statutory duty under the AEA to insure that the public health and safety is adequately protected. Relying on other governmental bodies to address a risk is not equivalent to ignoring the risk." Riverkeeper, 359 F.3d at 170;[9]see also 42 U.S.C. § 2201(f) (authorizing the Commission to utilize other Federal agencies to perform such functions on its behalf as may appear desirable). Here the Commission is not merely relying on other government bodies, but is an active participant in coordinating for protection of nuclear facilities. See 72 Fed.Reg. 12,705, 12,710. The NRC's reliance on other government agencies, whose charge is to provide security and defense of the nation against such attacks, is neither inconsistent with its past practices nor an unreasonable interpretation of its statutory obligations. Petitioners' argument that the NRC's inclusion of passive measures to protect against vehicle threats in the 1994 revision necessitates the inclusion of passive measures against airborne threats now, is unavailing. In the 1994 DBT rule, the Commission explicitly stated that its decision to include passive barriers against vehicle intrusions and explosions was not based on adequate protection, but as a "matter of prudence" to provide a "substantial increase in protection." 59 Fed.Reg. 38,889, 38,891, 896. Thus, it cannot be said here that the Commission is obligated to find, based on prior decisions, that passive measures are necessary to provide adequate protection.[10] And, as discussed above, the Commission was consistent in including within the scope of the DBT rule only those threats a private force can reasonably be expected to defend against. The NRC's determination that private forces can reasonably defend against vehicle and water-based attacks does not require the Commission to come to the same conclusion regarding airborne threats. Once the Commission determined that adequate protection was met, it was under no obligation to further consider the beamhenge concept outlined in the CBG petition. *927 Petitioners also argue that the Commission improperly considered cost in its assessment. This allegation has no basis in the record. The Commission has consistently stated that its determination of adequate protection was not based on cost. 72 Fed.Reg. 12,705, 12,714. The NRC has provided sufficient explanation of the reasonableness standard to show that it is animated by considerations of practicality, feasability, and the proper division of defense between government agencies rather than cost concerns. For example, Petitioners argue that any reasonableness limitation on the size of a private security force must be driven by cost. This argument ignores potential basic feasability concerns that may arise with maintaining facilities for a private "standing army." The Commission's decision to limit the size of private security forces is neither arbitrary nor an abuse of the Commissioner's discretion. Moreover, because the Commission found that the adequate protection standard was satisfied through mitigation measures and active defense by other federal agencies, any decision to include airbased threats in the DBT could have properly considered costs. When the NRC uses its permissive authority to extend public safety measures beyond those required by "adequate protection," it may legitimately include costs in its assessment. See Concerned Scientists I, 824 F.2d at 118. C. Compliance with Congress's Directives in 42 U.S.C. § 2210e Petitioners also contend that the Commission's final rule is contrary to law because the Commission failed to comply with Congress's directive to "consider" "the potential for water-based and airbased threats." § 2210e(b)(6). This argument is without merit. The Commission thoroughly discussed its assessment of airbased threats in the final rule. The Commission also implemented many mitigative measures to limit the effects of an airstrike and coordinated with other agencies to prevent an airborne attack. The direction to "consider" nonexclusive factors does not necessitate including that factor in the final rule, as Petitioners admit. The NRC's interpretation of the directive from Congress is reasonable. The statute has no legislative history that could counter the Commission's interpretation, nor can it be assumed, given the "virtually unique" authority of the NRC to achieve its statutory objectives, see Siegel, 400 F.2d at 783, that Congress intended to interfere with the Commission's authority any more than is facially clear from the statute. Petitioner's argument that air-based threats must necessarily be within the scope of the DBT rule simply because they were included as a § 2210e factor is also flawed. The Commission does not argue that it could not have legally chosen to include air-based threats within the scope of the DBT. Section 2210e allowed the Commission the flexibility to determine whether or not to include each individual factor in the final rule. There is no indication that the Commission could not exercise that discretion in determining a factor was beyond the scope of the DBT rule, rather than excluding the factor on any other discretionary basis.[11] Petitioners cite no authority to so limit the Commission's discretion where a factor is not mandated by Congress and we decline to imply any such limitation. Compare Public Citizen v. FMCSA, 374 F.3d 1209, 1216 (D.C.Cir.2004) (finding agency rule arbitrary and capricious where the "agency *928 neglected to consider a statutorily mandated factor" under its organic statute). D. Reliance on Non-Public Information Petitioners next argue that the Commission improperly relied on non-public information when engaging in the DBT rulemaking. The cases relied upon by Petitioners, however, involve cases where an agency relies on general factual information not provided to the public, and do not govern this case. See, e.g., Kern County Farm Bur. v. Allen, 450 F.3d 1072, 1076 (9th Cir.2006). Here, the AEA specifically allows the Commission to maintain "safeguards information" that is not available to the public. 42 U.S.C. §§ 2167, 2201(i); see also 10 C.F.R. § 73.21. The APA also exempts from the general rule information it is specifically authorized to withhold from public scrutiny. See 5 U.S.C. § 552(b)(3). The Commission cannot be required to reveal classified information about nuclear facilities, nor would it be able to do so while fulfilling its duty to maintain the common defense and security of classified information. See also Siegel, 400 F.2d at 786("When, as here, a statute does not require that a particular kind of rule making be on a record made after a public hearing, the Commission is not confined to evidence presented in some formal manner. It may act not only on the basis of the comments received in response to its notice of rule making, but also upon the basis of information available in its own files, and upon the knowledge and expertise of the agency.") (citing Pacific Coast European Conference v. United States, 350 F.2d 197, 205 (9th Cir.1965)). We hold the Commission acted neither arbitrarily or capriciously in excluding the threat of air-based attacks from the scope of the DBT rule, nor contrary to law in finding that adequate protection was satisfied without incorporating passive protective measures against air-based attacks in the DBT rule. E. NEPA Analysis Petitioners also challenge the sufficiency of the EA provided by the Commission, arguing that the NRC should have analyzed its decision to exclude air-based threats from the DBT rule and included that environmental analysis in the alternative action portion of the EA. They argue that the decision to exclude air-based threats is an agency action that "increases the risk of a successful terrorist attack," and that that decision produces its own adverse environmental affects. Petitioners rely on this court's decisions in Center for Biological Diversity v. NHTSA, 538 F.3d 1172, 1216 (9th Cir.2008), and San Luis Obispo Mothers for Peace v. NRC (Mothers for Peace), 449 F.3d 1016 (9th Cir. 2006). "An EA shall include brief discussions of the need for the proposal and the environmental impacts of the proposed action and alternatives." Center for Biological Diversity, 538 F.3d at 1215 (quoting 40 C.F.R. § 1508.9(b))(internal citations and alterations omitted). Because the Commission acted within its discretion in concluding that air-based threats were beyond the scope of the DBT rule, however, it was unnecessary for the Commission to consider that decision as an alternative course within the scope of the rule. The Commission's determination that air-based threats were outside the scope of the DBT rule distinguishes this case from a case like Center for Biological Diversity, where we held an agency must consider a broad range of alternative actions within the scope of the rule at issue, beyond those alternatives the agency seriously considered. We decline to extend that holding to create a rule that ignores reasonable boundaries in the scope of an EA alternative action analysis. The Commission did *929 not merely select among a range of options, but instead determined air-based threats were not properly addressed by the DBT rule. As noted above, this decision was within the Commission's discretion and it need not include an analysis of air-based threats within the EA alternative action section. By only highlighting one potential deficiency in the EA that could impact the environment, petitioners implicitly agree with the Commission's argument that the rule was otherwise only beneficial to the environment, because it reduced the threat of a terrorist attack. Therefore, we do not address whether the NRC violated this court's holding in Mothers for Peace, or whether the effects of an air-based attack (rather than the possibility of a terrorist attack) were too speculative to necessitate their inclusion in the EA. See Mothers for Peace, 449 F.3d at 1033-1034. Because Petitioners have identified no effect of the revised DBT rule that "may cause significant degradation of some human environmental factor," no EIS was necessary. Center for Biological Diversity, 538 F.3d at 1219(quoting Idaho Sporting Cong. v. Thomas, 137 F.3d 1146, 1149 (9th Cir. 1998)); see also Douglas County v. Babbitt, 48 F.3d 1495, 1505 (9th Cir.1995) ("[A]n EA or an EIS is not necessary for federal actions that conserve the environment."). PETITION DENIED. THOMAS, Circuit Judge, concurring in part and dissenting in part: I join the majority in holding that the Nuclear Regulatory Commission's ("NRC") use of a "reasonable expectation" standard as a proxy for the division of responsibility between public and private forces is not arbitrary and capricious, that the NRC did not improperly withhold safeguarded information, and that the NRC did not violate the National Environmental Policy Act. However, I would grant the petition for review as to whether the NRC acted arbitrarily and capriciously in excluding air-based threats from the Design Basis Threat ("DBT") rule. No one disputes that there is a credible threat of terrorists using commercial aircraft to attack nuclear power plants. Nevertheless, the NRC concludes it was not necessary to include air-based threats in its DBT rule because: (1) other federal agencies will largely prevent such attacks in the first instance, and (2) the effects of any successful attack will be minimal, or at least minimized. The NRC claims it conducted "detailed, site-specific engineering studies" that "confirm the low likelihood of [an airplane attack] both damaging the reactor core and releasing radioactivity that could affect public health and safety." Unfortunately, this comforting conclusion directly contradicts the unanimous findings of the studies available in the administrative record—some commissioned by the NRC itself—that some of our nuclear facilities may not be able to withstand the impact of a commercial jet airplane. One study found that an aircraft strike could cause radioactive leakage along with "[e]xtensive destruction of [the] reactor building."[1] One cautioned that a core meltdown could result from even a light aircraft striking a nuclear plant's control building,[2] and another similarly concluded *930 that even a small plane could damage a plant's reactor core.[3] Still another, performed by the Argonne National Laboratory, warned that an airplane strike causing rapid depressurization of the plant's secondary cooling system might very well cause "serious damage if not total meltdown."[4] Even the NRC itself has recently determined that an airplane strike has a substantial chance of causing "catastrophic" damage to spent nuclear fuel pools.[5] The studies referenced in the DBT rule, which apparently[6] "confirm" the low likelihood of radioactive release, are the sole exceptions. Of course, we must defer to an agency's expertise in weighing evidence. However, there is no sign in this record that the agency conducted that exercise here. Not only did the NRC fail to rebut the multitude of studies that conflicted with its own assessment, but it failed to even mention the contrary studies. This failure alone is grounds to grant the petition. See Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43, 103 S.Ct. 2856, 77 L.Ed.2d 443 (1983) (noting that an agency's failure to offer an explanation for its decision that runs counter to the evidence before it is arbitrary and capricious); Islander E. Pipeline Co. v. State of Connecticut, 467 F.3d 295, 313(2d Cir. 2006) (observing that an agency's failure to mention contrary scientific studies renders its conclusions arbitrary and capricious). Moreover, the NRC's determination that nuclear plants can successfully withstand airplane strikes contradicts the agency's own analysis. In its previous DBT rule, the NRC found that truck bombs can inflict severe damage on nuclear power plants. See Nuclear Regulatory Commission, Protection Against Malevolent Use of Vehicles at Nuclear Power Plants, 59 Fed. Reg. 38889, 38891 (August 1, 1994) (stating that such bombs' "contribution to [nuclear] core damage frequency could be high"). The NRC provides no explanation as to why we should fear the effects of a truck bomb attack, but not those of a commercial airliner strike. Nor does the NRC explain why the construction of passive structural barriers is a critical component of defense against truck bomb attacks, while it is completely unnecessary for the NRC even to consider the installation of passive barrier defenses (such as beamhenges) to attacks by air. The distinction the agency draws between the risk of truck bombs and hijacked airliner attacks is inconsistent with our nation's recent tragic experiences and common sense. Although we owe the NRC considerable deference, the NRC owes the public a rational and reasonable explanation why it would exclude from its rule consideration of terrorist air attacks on nuclear facilities. In the face of near-uniform scientific studies warning of serious risk, bare assurances by the NRC that we are safe do not satisfy this minimal agency burden. NOTES [1] New York's petition for review was properly transferred to this court and consolidated with the petition of Public Citizen pursuant to 28 U.S.C. § 2112(a)(5). [2] The "beamhenge" concept involves a shield constructed of I-beams with steel or other cabling and netting between them at standoff distances around key structures at nuclear plants. See http://www.committeeto bridgethegap.org/beamhenge.html. [3] Attorneys General from seven states, including New York, filed written comments in support of the CBG petition in January 2005. [4] The twelve non-exclusive factors the Commission was instructed to consider are: "(1) the events of September 11, 2001; (2) an assessment of physical, cyber, biochemical, and other terrorist threats; (3) the potential for attack on facilities by multiple coordinated teams of a large number of individuals; (4) the potential for assistance in an attack from several persons employed at the facility; (5) the potential for suicide attacks; (6) the potential for water-based and air-based threats; (7) the potential for use of explosive devices of considerable size and other modern weaponry; (8) the potential for attacks by persons with sophisticated knowledge of facility operations; (9) the potential for fires, especially fires of long duration; (10) the potential for attacks on spent fuel shipments by multiple coordinated teams of a large number of individuals; (11) the adequacy of planning to protect the public health and safety at and around nuclear facilities, as appropriate, in the event of a terrorist attack against a nuclear facility; and (12) the potential for theft and diversion of nuclear materials from such facilities." § 2210e. [5] The Commission continues to evaluate air-based threats even after the revised DBT rule. In October 2007, the Commission issued a proposed rule to amend 10 C.F.R. § 52 (Design Features) with the objective of "requir[ing] nuclear power plant designers to perform a rigorous assessment of design features that could provide additional inherent protections to avoid or mitigate, to the extent practicable, the effects of an aircraft impact, with reduced reliance on operator actions." 72 Fed.Reg. 56,287 (Oct. 3, 2007) (emphasis added). The NRC issued a press release on February 17, 2009, announcing it had issued its final rule requiring "applicants for new power reactors to assess the ability of their reactor designs to avoid or mitigate the effects of a large commercial aircraft impact." See http://www.nrc.gov/reading-rm/doc-collections/news/2009/09-030.html (last visited May 15, 2009). The press release reiterates the NRC's consistent position that the new design features "will result in a margin of safety far beyond that required to achieve reasonable assurance of public health and safety," and that the responsibility of preventing the impact of large commercial aircraft rests with the federal government as it is a beyond-design-basis event. Id. (emphasis in original). [6] The Commission acknowledges a standard has intentionally not been articulated so as to preserve the Commission's flexibility. See 72 Fed.Reg. 12,705, 12,713; see also Concerned Scientists II, 880 F.2d at 558. [7] The Commission has issued a final rule to modify the design features of nuclear facilities to better withstand the impact of an air-based attack. See supra n. 5. [8] The extremely broad discretion granted to the Commission to ignore the risks of enemy attacks and sabotage in assessing adequate protection by the Siegel court, see 400 F.2d at 783-784, however, would not apply today given the Commission's own establishment of DBTs under the adequate protection standard and Congress's direction in 42 U.S.C. § 2210e. See also Riverkeeper, 359 F.3d at 168 n. 14. [9] The Riverkeeper court also noted that the "FAA and Department of Defense have acted more than once to protect airspace above nuclear power plants from what were thought to be credible threats against specific sites." 359 F.3d at 169. [10] It is also reasonable for the Commission to treat the interagency response to air-based threats differently than in land vehicle or waterbased vehicle attacks. There are far fewer airplanes than either trucks or boats, and they are far more regulated. Airspace is monitored by federal agencies in a manner which cannot be duplicated on all of the nation's roadways and waterways. [11] Moreover, the first factor listed in § 2210e is "the events of September 11, 2001." This illustrates that Congress could not have reasonably expected the NRC to treat the factors as a sort of shopping list of threats to include wholesale in the final rule, without further agency analysis and expertise. [1] GERMAN REACTOR SAFETY ORG., PROTECTION OF GERMAN NUCLEAR POWER PLANTS AGAINST THE BACKGROUND OF THE TERRORIST ATTACKS IN THE U.S. on SEPT. 11, 2001, at 7-9 (Greenpeace Germany trans.) (2002), available at http://www.greenpeace.org/raw/content/ international/press/reports/protection-of-german-nuclear-p-2.pdf. [2] POWER AUTH. OF THE STATE OF NEW YORK & CONSOL. EDISON CO., INDIAN POINT PROBABILISTIC SAFETY STUDY 7.6-3 (1982). [3] Ian B. Wall, Probabilistic Assessment of Aircraft Risk for Nuclear Power Plants, 15 NUCLEAR SAFETY 276 (1974). [4] C.A. KOT, ET AL., ARGONNE NATIONAL LABORATORY EVALUATION OF AIRCRAFT CRASH HAZARDS ANALYSES FOR NUCLEAR POWER PLANTS 51-52 (1982). [5] NUCLEAR REGULATORY COMMISSION, TECHNICAL STUDY OF SPENT FUEL POOL ACCIDENT RISK AT DECOMISSIONING NUCLEAR POWER PLANTS at3-23 (2001); see also NAT'L ACAD. OF SCICIENTISTS, SAFETY AND SECURITY OF COMMERCIAL SPENT NUCLEAR FUEL STORAGE (2006). [6] We must accept on faith that the NRC's studies actually stand for the proposition for which they are cited, as the agency has not offered them for our in camera review, even in redacted form.