The 104 nuclear power plants in the U.S. “remain inadequately protected against two credible terrorist threats” — theft of nuclear material and 9-11-like sabotage attacks, a study prepared for the Pentagon found.

“More than a decade after the worst terrorist attack in U.S. history, operators of existing nuclear facilities are still not required to defend against the number of terrorist teams or attackers associated with 9/11, nor against airplane attacks, nor even against readily available weapons such as high-power sniper rifles,” the Nuclear Proliferation Prevention Project said in releasing its report on Thursday.

Among the most vulnerable: eight plants that are “are vulnerable to terrorist attack from the sea, but they are not required to protect against such ship-borne attacks.” Those eight are shown in the map below; click on each star for more details.

Three civilian operations that involve bomb-grade nuclear material are also a risk. “These facilities are not defended against a posited terrorist threat, unlike military facilities that hold the same material.” The three are at the University of Missouri in Columbia, the Massachusetts Institute of Technology in Cambridge, and the National Institute of Standards and Technology just outside Washington, DC.

The Nuclear Regulatory Commission dismissed the report. Here’s what Reuters said:

“The NRC called the report, which was requested by the Pentagon, a “rehash of arguments from a decade ago,” when the agency and the country were reconsidering nuclear power plant security in the wake of 9/11.

“The report contains no new information or insight,” said David McIntyre, an NRC spokesman. He said the agency had strengthened security requirements for commercial nuclear power plants and was confident that these were adequately protected.