The report said that the Nuclear Regulatory Commission's inspection reports were found to not include incidents such as a guard found sleeping or falsification of security logs as security violations.
It also said that attack exercises that are supposed to test a plant's ability to detect and repel a mock terrorist assault often are staged in such ways that they provide false assurances about a facility's security.
The findings by the General Accounting Office, the investigative arm of Congress, mirror claims made by nuclear industry watchdog groups and some industry whistle-blowers. They maintain that security at nuclear power plants, despite some recent attempts at improvement, cannot deal with a sophisticated, well-armed terrorist attack.
Neither NRC officials or industry representatives could be reached immediately. The report was released late Wednesday.
In the past, industry representatives have said they have made major improvements in security since the attacks of Sept. 11, 2001.
NRC officials have defended their inspection program and exercises as providing valuable experience and information that is used to improve reactor-site security. They argue if it made too realistic and no advance notice is provided an exercised could end up with someone being shot.
But Reps. Edward Markey, D-Mass., and John Dingell, D-Mich., who requested the report, said the findings demonstrate that not enough has been done to assure that nuclear power plants are being safeguarded against terrorists.
Congressional investigators have "documented a disturbing pattern of lax NRC oversight and inattention to security at these sensitive facilities," said Markey, a senior member of the House Homeland Security Committee and a frequent critic of the NRC.
Dingell, ranking Democrat on the Energy and Commerce Committee, which has jurisdiction over the nuclear agency, said the report is "a makeup call to the NRC that they need to change their attitudes about nuclear security."
The report was particularly critical of the NRC's annual security inspections, saying that they "may overstate the level of security" at power plants by not citing certain shortcomings and by not assuring that failures are fixed.
It cited as one example a case where a security guard was found asleep on duty for more than half an hour. The NRC inspector called it a "non-cited violation" because no attack had taken place and because the incident appeared not to be a regular occurrence.
As to the mock exercises, investigators said they did not reflect "the real life" ability of guard forces to defend against actual terrorist threats. For example, according to the report, the NRC exercises:
- allow plant operators advance warning. On the night of the mock attack, they often have as much as 80 percent more guards on duty than normal.
- often use "mock terrorists" not trained in terrorist techniques including at times off-duty plant managers and guards who may have a vested interest in how the tests turn out.
- allow attackers to use "unrealistic weapons" such as rubber guns that do not accurately reflect attack situations.
Peter Stockton, an investigator for Project on Government Oversight, a private watchdog group that has raised many of the same security issues as cited by the GAO, said he found it "mystifying" that guard forces could be inflated for the mock exercises.
According to the NRC, there are 104 nuclear power plants in the United States, providing about a fifth of the power Americans use.
Since Sept. 11, unease has grown about some nuclear plants' vulnerability to attack. In New York State, worries that the evacuation plan for the area around the Indian Point plant led state officials to refuse to certify the plan. A federal agency later certified it.