Nuclear power plants must be able to repel a small group of terrorists, possibly working with an insider, but security rules don't require them to be ready for a rocket-propelled grenade or a large truck bomb.

If attacked by air or a large force, they'll call in government backup, but they don't prepare through drills.

Will more Americans have to die before that changes?

The nuclear industry claims it has made great strides in security since 9/11, but a House hearing and audit last week found otherwise.

The Government Accountability Office concluded that the Nuclear Regulatory Commission had identified the right threats to plants but had scaled back security requirements "based on what industry considered reasonable and feasible."

The report makes you wonder who the NRC works for — the public or the nuclear plant owners? But this is about much more than that. It's about what the GAO politely calls "an attack that could cause a release of radioactive material and endanger public health and safety through exposure to an elevated level of radiation."

Flash back to Three Mile Island, only this time the public's worst nightmare comes true.

The nuclear industry and government shouldn't be trying to pass off responsibility over plant security; they should be devising the best way to safeguard Americans — inside and outside the reactor fence.

Nuclear plants have invested more than $1 billion in security since the Sept. 11, 2001, attacks, including barriers and detection equipment, protective strategies and security guards. In some cases, sites went beyond what the NRC required.

The GAO concluded, though, that it was premature to deem all sites safe, because the NRC had inspected only 27, or less than half, of the 65 sites hosting the nation's 103 commercial reactors. While most sites passed both baseline inspections and simulated attacks, the NRC found malfunctioning alarms and other breaches, such as failure to search personnel.

The real debate is whether the NRC's standards are adequate to begin with.

Industry reportedly complained about the cost and practicality of securing plants against certain threats, such as .50-caliber sniper rifles and rocket-propelled grenades, so the NRC dropped the requirement. The NRC also reduced the size of vehicle bombs that the plants would have to guard against.

"The Nuclear Regulatory Commission seems unable to fortify itself against the dangers of an overly cozy relationship with the industry," said Rep. Christopher Shays, R-Conn., who conducted a hearing on nuclear plant security last week.

Last April, the National Academies of Science disagreed with the NRC on how to reduce another vulnerability: onsite storage of spent fuel.

At a time when more nuclear power seems inevitable to diversify the nation's fuel supply, the NRC cannot be lax in ensuring plant security.