The United States faces “challenges” in trying to secure radiological equipment used in a range of industries that could become part of a “dirty bomb” used in an attack, the Government Accountability Office reported on Thursday.

Visits to 33 industrial sites across the country involved in oil and gas production, aerospace and food sterilization revealed vulnerabilities in how companies store radiological equipment that range in size from several inches long to as small as a grain of ice.

“In the hands of terrorists, these sources could be used to produce a simple and crude, but potentially dangerous weapon, known as a radiological dispersal device or dirty bomb,” GAO researcher David Trimble wrote in the report to the Senate Homeland Security and Governmental Affairs Committee.

“Challenges exist in reducing the security risks faced by [nuclear] licensees using high-risk industrial radiological sources” even when they follow the Nuclear Regulatory Commission’s security controls, he said.

Seven of the 33 sites had allowed people with criminal histories unescorted access to radiological materials, the report found. Researchers noted an open door and incomplete fencing at one site and found unsecured skylights at nine locations.

The report noted that radiological materials had been stolen from trucks at U.S. industrial sites four times, with materials recovered in all but one of those cases.

James Acton, a senior associate at the Carnegie Endowment for International Peace in Washington, said that radiological terrorism, such as a “dirty bomb,” had historically been seen as a low risk.

“It’s a bit of a mystery why we haven’t seen radiological terrorism yet. It’s not that technically demanding” and materials are available, especially in hospitals, he said.

About 3,000 U.S. buildings house high-risk radiological materials.

The GAO said among its recommendations that federal agencies should collaborate to provide security and seek comment from companies.

The NRC and the National Nuclear Security Administration largely agreed with the recommendations. Acton called the recommendations “basic sensible precautions.”

(Reporting by Ian Simpson; Editing by Peter Cooney)