Congressional investigators set up a bogus company with only a postal box and within a month obtained a license from the Nuclear Regulatory Commission that allowed them to buy enough radioactive material for a small "dirty bomb."

Sen. Norm Coleman, R-Minn., who will ask the NRC about the incident at a Senate hearing Thursday, said the sting operation raises concerns about terrorists obtaining such material just as easily.

Nobody at the NRC checked whether the company was legitimate and an agency official even helped the investigators fill out the application form, Coleman said in an interview Wednesday.

The Nuclear Regulatory Commission acknowledged that more checking is needed in such licensing and said that since being told of the GAO sting operation it has tightened licensing procedures.

"We've fixed the problem," said NRC Commissioner Edward McGaffigan in an interview Wednesday. He said that such licenses now will require visits to the company or in some cases company officials will have to come to NRC offices.

The license that was obtained allowed for the purchase of up to five portable moisture density gauges widely used in construction, in which are encased small amounts of cesium-137 and americium 241, two highly radioactive isotopes.

Individually, these devices pose little threat because of the small amount of radioactive material, radiation experts say. Still the devices require an NRC license to be purchased and must be closely safeguarded by companies that use them to avoid theft.

But the investigators from the Government Accountability Office, Congress' investigative arm, found a way to purchase as many as 45 of the gauges and could have bought many more because they duplicated the NRC-issued license and removed the restrictions on the amount that could be purchased.

"With patience and the proper financial resources, we could have accumulated from other suppliers substantially more radioactive source material than what the two supplies initially agreed to ship to us," says the GAO in a report prepared for Thursday's hearing.

Coleman, the ranking Republican on the Homeland Security and Governmental Affairs investigations subcommittee, said the NRC "still has this good-faith assumption. The problem is there are bad-faith people out there."

He said "there is no question" they could have obtained enough radioactive material to make a dirty bomb because the GAO was able to duplicate the certificate and no one checked on the company or whether the counterfeit license was legitimate.

A so-called dirty bomb could spread radiation by a conventional explosion but does not have a nuclear detonation. While experts believe such a bomb would not cause casualties beyond those affected by the explosion, such an attack could have significant psychological impact and have serious economy consequences because of cleanup problems.

The GAO said that investigators operated the sting from their Washington office, although they provided a postal box in West Virginia. At one point, an NRC license examiner called them to caution that the gauges are subject to special security at the construction site.

The GAO said that it contacted two suppliers of the gauges and that one "offered to provide twice as many machines as we requested and offered a discount for volume purchases." The investigators also were told that the supplier does not check with NRC to confirm the terms on the license, a copy of which was sent to the supplier along with the purchase order.

The GAO investigators never finished the deal because they didn't have the money to buy the machines — which can cost several thousand dollars apiece — and also didn't have any place to safely store them.

The GAO also tried to get a license from the state of Maryland, one of 34 states that the NRC has given authority to handle such licensing. Unlike the NRC, the Maryland officials said they wanted to visit the company, so the investigators withdrew their application.