Lecture: Nuclear Security

NUCE 304: Evaluative Methods for Nuclear Non-proliferation and Security Nuclear Security (Part 1) Dr. Ahmed Alkaabi 1  Introduction to the International Nuclear Security Regime 2  International Security Regime Timeline 3 ...

NUCE 304: Evaluative Methods for Nuclear Non-proliferation and Security Nuclear Security (Part 1) Dr. Ahmed Alkaabi 1  Introduction to the International Nuclear Security Regime 2  International Security Regime Timeline 3  Risk of Nuclear Material “The risk that nuclear or other radioactive material could be used in criminal or intentional unauthorized acts remains a matter of concern internationally and continues to be regarded as a threat to international security” – IAEA Nuclear Security Plan 2014-2017 4  Non-Proliferation Goals by IAEA Contribute to global efforts to secure nuclear and other radiological material in use / storage / transport Assist States in implementing full range of international legal instruments for nuclear security 5  State’s Nuclear Security Regime Per INFCIRC/225/Rev/5: “The overall objective of a State’s nuclear security regime is to protect persons, property, society, and the environment from malicious acts involving nuclear material and other radioactive material.” – Section 2.1 Cornerstone for physical protection 6  Nuclear Security Regime An effective nuclear security infrastructure requires a multi-disciplinary approach with: – Clearly defined legal and regulatory systems – Human resource development – Established procedures and functions – Technical support at regional / national / facility levels 7  Nuclear Security International Guidelines Nuclear Security Fundamentals: Contain objectives, concepts, and principles of nuclear security and provide the basis for security recommendations. Recommendations: Present best practices that should be adopted by Member States in the application of the Nuclear Security Fundamentals. Implementing Guides: Provide further elaboration of the Recommendations in broad areas and suggest measures for their implementation. Technical Guidance: Publications comprise Reference Manuals, with detailed measures and/or guidance on how to apply the Implementing Guides in specific fields or activities; Training Guides, covering the syllabus and/or manuals for IAEA training courses in the area of nuclear security; and Service Guides, which provide guidance on the conduct and scope of IAEA nuclear security advisory missions. 8  Nuclear Security and local authority State Level Individual Responsibilities Responsibilities outlines provides & describes best teaches explains & defines practices & International Facility Level cultivates Security Regime Responsibilities 9  Summary Nuclear and radioactive material pose a unique and significant threat The international security regime is a framework of international legal instruments implemented at a national and facility level Best practices in nuclear security are implemented at the international, State, facility, and individual level 10  Insider Threat Analysis 11  Insider Definition Insider: One or more individuals with authorized access to nuclear facilities or nuclear material in transport who could attempt unauthorized removal or sabotage, or who could aid an external adversary to do so.(From INFCIRC/225/Rev. 5.) Insiders might include, but are not limited to: – Management – Regular employees – Security personnel – Service providers – Visitors – Inspectors 12  Insider Categories All insiders can use stealth and deceit 13  Insider Attributes Authorized access to nuclear facilities or transport (from definition) Authority – Over personnel and operations – To acquire / use tools, equipment, weapons, or explosives Knowledge – Technical skills and expertise 14  Insider Access Authorized access to work areas Special temporary access Escorted or unescorted – Restrictions on insider during access Emergency access (fire, medical, police) Unauthorized access – Easy to obtain? Conditions of target during insider access – When is material most vulnerable? Protection equipment and process tools Special site equipment Access to special knowledge 15  Insider Authority Over people – Designated authority over others – Personal influence over others Over tasks and equipment – Assessment of alarms – Preparation of sensitive forms – Authorization of processes and procedures Temporary authority Falsified authority Exemption from procedures Use in coercion 16  Insider Knowledge Targets – Locations, characteristics, and other details of targets – Details of facility layout Security Systems – Security force capabilities and communications – Details of facility and security operations – Location and details of safety and security protection systems – Skills to use machines, tools, or special equipment – Bypass detection equipment Special tools and equipment – Storage details, entry controls, use 17  Opportunity Access Authority Insider Knowledge Opportunity 18  Insider Motivations Political Note: Ideological – Fanatical conviction Motivation is an – Moscow Theater important indicator for both level of Financial – Wants/needs money malicious intent – General Electric and likelihood of attempt Personal – Revenge – Disgruntled employee or customer – Ego – “Look what I am smart enough to do” Hackers Psychotic – Mentally unstable but capable Coercion – Family or self-threatened – 2006 London Robbery 19  Factors Affecting Insider Attempt Access Authority Insider Opportunity Knowledge Political + → Insider Attempt Ideological Insider Financial Motivations Personal 20  Insider Advantages Time – Can select optimum time to implement plan – Can extend actions over long periods of time Tools – Has knowledge of and capability to use tools already at work location Tests – Can test the system with normal “mistakes” Teamwork (Collusion) – May recruit/collude with others, either insiders or outsiders 21  Insider Definition Summary Categories – Passive – Active Nonviolent – Active Violent Facility Insider Characteristics – Access, authority, knowledge – Motivation Insider Advantages – Time – Tools – Tests – Teamwork 22  System Approach to Prevent and Protect Against Insiders 1. Exclude Potential Insiders 2. Remove Potential Insiders, reduce motivation 3. Minimize opportunity 4. Detect, delay, People and respond 5. Mitigate applying People Trusted consequences for access with people Insider access with initiating a Insider opportunity malicious completing act malicious act 23 NSS-08  Introduction to Personnel Security Programs (PSP) 24  Nuclear Security Threats and Risks Nuclear research and energy programs offer many benefits, but also risks: – Accidents involving release of radioactive materials – Sabotage of facilities – Theft or diversion of material, technology, or information for malicious purposes – Use of material in a radiological dispersal device or improvised nuclear device Nuclear security events can lead to severe consequences: – Injury and loss of life – Environmental damage – Economic impact – Social disruption 25  The Human Dimension and Insider Threats All of these nuclear security risks have a human dimension Personnel have a positive role to play in preventing, detecting, and responding to nuclear security events Under certain circumstances, personnel may also play a negative role, facilitating nuclear security incidents through: – Lack of awareness – Negligence – Accidental or unintentional acts – Malicious acts – the “insider threat” Insider Threat: An adversary with authorized access to a nuclear facility, a transport operation or sensitive information. Insiders can take advantage of their access, complemented by their authority and knowledge of the facility, to bypass dedicated physical protection elements or other provisions such as safety, nuclear material control and accountancy, and operating measures and procedures. (IAEA NSS-8) 26  Look Familiar? 1. Exclude Potential Insiders 2. Remove Potential Insiders, reduce motivation 3. Minimize opportunity 4. Detect, delay, People and respond 5. Mitigate applying for People with consequences Trusted access access Insider people with opportunity initiating a Insider malicious completing act malicious act Preventive Measures Protective Measures 27  PSP Implementation Framework While there is no consensus in international framework for PSP implementation, most programs include four basic elements: – Threat and Risk Assessment – Personnel Security Requirements – PSP Implementation – Review and Assessment 28  Threat and Risk Assessment The development of a PSP should be informed by an assessment of threats and risks Assessment includes consideration of: – Potential adversaries, including their intent, capabilities, and tactics – The types of nuclear materials, facilities, and information that may be exploited by such adversaries – The opportunities and motivations for insiders to assist or otherwise be exploited by potential adversaries 29  Graded Risks Risks vary depending on the facility or materials under consideration; the same is true of associated personnel. The depth of trustworthiness checks should be graded according to the level of access granted to the individual. VS. VS. Nuclear Research Nuclear Power Waste Storage Facility Facility Facility VS. VS. VS. VS. Facility Lab Technician Control Room Facility Guards Janitor Researcher Operators 30  Personnel Security Requirements Personnel security requirements should be informed by the threat and risk assessment Requirements include: – Identification of access level Information clearance levels (e.g., Confidential, Secret, Top Secret) Access to specific facilities or areas of facilities (e.g., “limited areas”) – Eligibility criteria for access levels “Need-to-Know” Ability to pass background and integrity checks Requirements should be codified through appropriate legal and regulatory mechanisms 31  PSP Implementation Security requirements are translated into implementation programs Program includes establishment and implementation of a standardized personnel screening process, to potentially include: – Pre-employment interviews, background checks, and investigations – Psychological and medical evaluations – Regular file review and re-investigation – Adjudication mechanisms for handling disputes 32  Personnel Screening Process The aim of preventive measures is to exclude potential adversaries and to minimize the likelihood of insiders attempting a malicious act. Measures could include – Identity Verification – Trustworthiness Assessments – Escort and Surveillance – Confidentiality – Sanctions 33  1. Identity Verification Identity verifications authenticate an individual’s identity, which confirms that the name and personal particulars of the individual in question are correct. 34  2. Trustworthiness Assessments Trustworthiness assessments are initial and ongoing assessments of an individual’s integrity, honesty and reliability in pre-employment checks, and checks during employment that are intended to identify the motivation or behavior of persons who could become insiders. Pre-employment checks can include: – Criminal records – References – Past work history – Financial records – Medical records – Psychological examinations/records – Political/Ideological interests – Desire for revenge (e.g. due to perceived injustice) – Physical dependency (e.g. drugs or alcohol) – Coercion risk (e.g. illegal activities) 35  2. Trustworthiness Assessments (continued) Periodic checks are essential since some conditions may not be apparent at first or may change over time. – Unusual Behaviors Mood swings Living above one’s means Lying to family, friends and co-workers Sudden changes in demeanor or personal grooming standards – These behaviors demonstrate inconsistencies from the norm and indicate a potential risk to both security and safety. Checks are also important for temporary employees and workers whose duties may place them close to sensitive targets. 36  3. Escort and Surveillance Maintenance, service or construction workers often come from outside companies. – The trustworthiness of these temporary workers and visitors may not have been determined prior to their being permitted access. Escorting such people is a way of making sure that they are in the right place and that they are performing their duties properly. – The escort should know about their approved activities, including access to specific places and actions they should not perform. 37  4. Confidentiality Information on security measures or sensitive targets should be kept confidential so that only those who need to know are permitted access to it. Information on potential vulnerabilities in security systems should be highly protected and compartmentalized. – In addition to information, certain facilities and activities should also be compartmentalized – Compartmentalized = Dividing information into separately controlled parts to prevent insiders from collecting all the information necessary to attempt a malicious act. 38  5. Sanctions Employees should know that the deliberate violation of laws and regulations may be severely sanctioned. The certainty of disciplinary action and prosecution may deter insiders from committing malicious acts. 39  PSP Implementation Formal requirements and processes should be supported by a robust nuclear security culture Organizations and individuals can reinforce personnel security best practices through promoting certain values: – Awareness – Reporting – Flexibility – Learning – Just practices Nuclear Security Culture: The assembly of characteristics, attitudes and behavior of individuals, organizations and institutions which serves as a means to support and enhance nuclear security. (IAEA NSS-7) 40  Nuclear Security Culture Only as good as people responsible for nuclear security Organizational nuclear security culture is influenced by – International community – State regulations – Public support – Organizational norms – Underlying beliefs and attitudes – Principles that guide decisions and behaviours – Management systems – Behaviours of leaders and employees 41  Implementation Challenges Trustworthiness must be determined before an individual is granted access to information, areas, materials and/or processes Assessments must be an ongoing process that includes periodic reviews National legislation may be required to undertake many of these assessments 42  Implementation Challenges Barriers to achieving high human reliability: Difficult to balance due diligence for quality security against an individual’s privacy. Differences always exist between what management wants and what employees believe is necessary. – Problem intensifies when employees believe a security program is designed to turn them against each other. Many people think that the insider threat might exist somewhere else, but “not in my organization.” – Must educate all employees on the insider threat. Zero-tolerance policies too harsh. – Violations could be caused by short-term medical conditions, personal problems that affect work production, and bad judgment and life choices – not by sinister intentions. Legal and regulatory constraints. – Regulations can sometimes overlap. 43  Implementation Challenges Barriers to achieving high human reliability: (continued) Zero-tolerance policies too harsh. – Violations could be caused by short-term medical conditions, personal problems that affect work production, and bad judgment and life choices – not by sinister intentions. Legal and regulatory constraints. – Regulations can sometimes overlap. Benefits vs. Expectations – For example, an expectation for an armed guard to risk death on the job for the same pay as a general laborer could increase the likelihood of that person accepting a bribe for inaction during an alarm. 44  Implementation Challenges Barriers to achieving high human reliability: (continued) Cultural attitudes toward personnel security programs – For example, trust in government, trust in providing individual health assessment data to authorities, and issues of invasion into a person’s private life vary according to culture. – Institutional allegiance affects the perceived need to investigate individuals – Legal approaches to violations differ country to country Most countries consider criminal, drug, alcohol and credit histories as part of pre-employment checks. Others take into account foreign travel, foreign property and cohabitation. Political and religious associations are not universally considered. 45  Review and Assessment A personnel security program should be regularly reviewed and assessed to determine its effectiveness Implementers should determine appropriate criteria for evaluation Personnel security incidents of concern should be investigated to determine root causes of personnel security failure 46  Implementation Cycle PSP implementation is not a one-time process Conduct Threat & Risk Assessment The PSP program should be responsive to changes, including: Establish – Evolving threats Review & Assess Personnel – Implementation of Security Programs Security Requirements lessons learned – Changes in the legal and regulatory environment – Acquisition of new Implement Personnel capabilities, facilities, Security Programs technologies, and materials 47  Information Security Analysis 48  Information Security – General Information Security is a goal that sensitive or valuable nuclear-related information is protected from theft, diversion, or malicious use. Challenges – Growth in electronic information and data networks – Opportunities for instant communications and unauthorized access – Increased expectation that sensitive information will be managed effectively 49  Nuclear Information Security – IAEA Description Information whose unauthorized disclosure, modification, alteration, destruction, or denial of use could compromise the security of a State or facilities associated with nuclear or other radioactive material, nuclear programs, or assist in malicious acts against a nuclear site, facility, organization or transport Such information includes physical protection at a nuclear facility, the location and transport of nuclear material or other radioactive material, or details of an organization’s personnel Source: Protection and Confidentiality of Sensitive Information in Nuclear Security, Draft Implementing Guide NST022, NSS-XX, Vienna, DRAFT, February 2013 https://gnssn.iaea.org/RTWS/general/Shared%20Documents/Transport%20Safety/TM- 44897/Documents%20for%20Review/Working%20Group%202/nst022.pdf 50  Nuclear Information Security – WINS Description Awareness of risk surrounding sensitive nuclear information Implementation of measures to ensure proper management of this information Prevent unauthorized people from acquiring and/or using nuclear and radiological material, facilities, or expertise for malicious purposes Procedures and protocols for protecting sensitive nuclear and radioactive materials, associated facilities, and information from unauthorized use Information security also involves protecting information to counter proliferation (i.e., Safeguards) Source: "Information Security for Operators: Challenges and Opportunities,” 2.3 WINS International Best Practice Guide, Managing and Communicating Information Security, Revision 1.0, September, 2011 https://www.wins.org/index.php?article_id=2&lang=1&pubid=191&view=detail 51  Nuclear Information Security – NRC Description Ensure that classified and sensitive information regarding the physical protection and safeguarding of nuclear materials or facilities related to US government programs is protected against unauthorized disclosure Safeguards information regarding the physical protection of operating power reactors, spent fuel shipments, strategic special nuclear material, or other radioactive material must be protected Source: http://www.nrc.gov/security/info-security.html#cfr 52  Information Security – Levels, Access, Classification, & Handling Information Security includes: – Identifying, classifying, marking, and protecting sensitive information from unauthorized disclosure – This information protection is generally authorized or required by governments, organizational policies, and/or laws 53  So, What is Information…? Information is knowledge It consists of ideas, concepts, events, processes, thoughts, facts, patterns, etc. Information can take numerous tangible and intangible forms, such as technical data, blueprints, drawings, designs, and security procedures and practices Different types of information require different kinds of protection! 54  Forms & Types of Information Information can be recorded on material such as paper, film or magnetic media, or held in electronic systems Information can be represented and communicated by almost any means, verbal, or written Can be a piece of hardware, a photograph, film, recording tapes, notes, drawings, documents or spoken words In the nuclear domain, there is a vast amount of information in many forms and communicated in many ways 55  Typical Nuclear-Related Information that Needs Protection Locations and amounts of nuclear material Sensitive or proprietary technology Operating procedures Facility designs Physical protection & Security measures IT security structures, firewalls, and defenses Transportation details Design basis threat (DBT) Emergency response & safety procedures & access Personally Identifiable Information (PII) Nuclear accountancy information – Safeguards 56  Key Steps to Take for Information that Needs Protection Identify Classify Mark Control Access & Distribution Store, Protect, & Control Retain Declassify or Destroy 57  “Need-to-Know” – NTK Need-To-Know is the determination by an authorized holder of information that another appropriately authorized individual requires access to the information in order to perform official duties Prior to disclosing information, the holder of the information ensures the recipient has – The appropriate level of clearance – Relevant training if required – Need-to-know It is better to delay release of information to an authorized person than to disclose information to an unauthorized person, or to one who does not have a need-to-know 58  Importance of Training Personnel must understand security principles and best practices until they become habitual in daily tasks and interactions 59  Summary Goal of Information Security – Assure that sensitive and valuable nuclear-related information is protected from theft, diversion, or malicious use Consists of – Identifying, classifying, marking, & protecting sensitive information from unauthorized disclosure Forms & Types – Verbal, paper, electronic; schematics, data, information Identification – Review to determine impact & consequences of loss, destruction, or misuse of the information Classification – Different types of information require different kinds of protection – Should be used only for information that is genuinely sensitive – Usually consists of 3 or 4 levels Need-to-Know: Determination that an individual requires access to the information in order to perform official duties The Importance of Training – Understand security principles & best practices until it becomes habitual in daily tasks and interactions 60