As usual I'm not going to make suggestions here, but I can think a few delivery methods which would do the job quite effectively.
It's a question of scale and accessibility, not just a theoretical binary 'might be.'
But I'll say again - there are different kinds of secrecy and security being discussed here as if they're identical.
They're not. There's no paradox between industry-wide openness and industry-wide security - or at least there shouldn't be. The information needed to reassure everyone that the industry is being run in a sane way is completely different to the information that terrorists might want to use.
One is about clarity of practice and professional emergency response. The other is very much about plant specifics.
So it's a useful data point that the two are being conflated by the industry itself, for its own benefit. There's no reason why they should be, and the fact that they are suggests that the industry is either not being run competently, or isn't used to be being completely truthful - or both.
The difference is that nuke waste could be used to kill a lot of people quite easily, with much more of an impact than a fertiliser bomb would.
Furthermore, the chemical explosives in your dirty bomb is bound to kill more people than the spent fuel itself.
Spread it into the water mains? Use ricin instead, or botulinium, dioxines, lead, or just the ordinary damn flu.
Bound to kill thousand of pensioners.
Spent fuel is hard to get, hard to deal with and strictly supervised. You can du much more damage with toxic chemicals or just plain fertiliser. Much easier to get and make too. Peak oil is not an energy crisis. It is a liquid fuel crisis.
