Security and safeguards

Hana's week on security and safeguards begins with a briefing she is not allowed to take notes in. Afterwards Elena explains why. "Most of what a licensee does on security is protected information, and rightly so. But the framework is public: the treaties, the laws, the regulations, the principles. That is what you need to understand as an engineer. You will design systems that security depends on, and you need to know what the rules are trying to achieve, even if you never see the threat assessment." This lesson stays at that public level.

Safety, security and safeguards

Nuclear regulators often speak of three S's. Safety is about preventing accidents and protecting people and the environment from radiation. Security is about preventing, detecting and responding to malicious acts, such as theft of nuclear material or sabotage of a facility. Safeguards are measures by which the International Atomic Energy Agency verifies that a state is using nuclear material only for peaceful purposes, as it has promised under international agreements. The three are distinct but overlap. A security measure such as limiting access to vital areas can complicate an emergency response, so safety and security requirements must be designed together. Material accountancy serves both security and safeguards.

The international framework

The legal basis for safeguards is the Treaty on the Non-Proliferation of Nuclear Weapons, which entered into force in 1970. Under it, non-nuclear-weapon states agree not to acquire nuclear weapons and to accept IAEA safeguards on all their nuclear material, through a comprehensive safeguards agreement based on the model in IAEA document INFCIRC/153. The 1997 model Additional Protocol, INFCIRC/540, gives the IAEA broader access to information and locations, so that it can verify not only that declared material is not diverted but also that there is no undeclared material or activity. Nuclear-weapon states under the treaty, including the United States, have voluntary offer agreements that let the IAEA apply safeguards at some of their civilian facilities.

Nuclear security has its own instruments. The Convention on the Physical Protection of Nuclear Material, which entered into force in 1987, originally covered nuclear material in international transport; its 2005 amendment, in force since 2016, extended it to domestic use, storage and transport and to the protection of facilities against sabotage. The International Convention for the Suppression of Acts of Nuclear Terrorism entered into force in 2007. UN Security Council Resolution 1540 of 2004 requires all states to adopt controls against the spread of weapons of mass destruction to non-state actors. The IAEA publishes non-binding guidance in its Nuclear Security Series, the best known being its recommendations on physical protection of nuclear material and facilities, often cited as INFCIRC/225/Revision 5. Export controls are coordinated through the Nuclear Suppliers Group, whose guidelines both countries apply.

# Timeline of major public instruments in nuclear safeguards and security.
events = [
    (1957, "IAEA established"),
    (1970, "Non-Proliferation Treaty enters into force"),
    (1972, "comprehensive safeguards model (INFCIRC/153)"),
    (1987, "physical protection convention enters into force"),
    (1997, "Additional Protocol model (INFCIRC/540)"),
    (2004, "UN Security Council Resolution 1540"),
    (2007, "nuclear terrorism convention enters into force"),
    (2011, "physical protection recommendations, revision 5"),
    (2016, "amended physical protection convention enters into force"),
]
prev = None
for year, what in events:
    gap = f"(+{year - prev} y)" if prev else ""
    print(f"{year} {gap:8s} {what}")
    prev = year
gaps = [b[0] - a[0] for a, b in zip(events, events[1:])]
print(f"span {events[-1][0] - events[0][0]} years, mean gap {sum(gaps)/len(gaps):.1f} years, longest gap {max(gaps)} years")

1957          IAEA established
1970 (+13 y)  Non-Proliferation Treaty enters into force
1972 (+2 y)   comprehensive safeguards model (INFCIRC/153)
1987 (+15 y)  physical protection convention enters into force
1997 (+10 y)  Additional Protocol model (INFCIRC/540)
2004 (+7 y)   UN Security Council Resolution 1540
2007 (+3 y)   nuclear terrorism convention enters into force
2011 (+4 y)   physical protection recommendations, revision 5
2016 (+5 y)   amended physical protection convention enters into force
span 59 years, mean gap 7.4 years, longest gap 15 years

The timeline shows how the regime grew in layers, often after events exposed gaps. The Additional Protocol followed the discovery in the early 1990s of an undeclared weapons programme in a state with a comprehensive safeguards agreement. The amendment to the physical protection convention and Resolution 1540 followed the attacks of September 2001, which changed how every country thought about the threat to nuclear facilities.

Canada's safeguards system

Canada signed a comprehensive safeguards agreement with the IAEA in 1972 and an Additional Protocol that entered into force in 2000. The CNSC is the national authority responsible for implementing them. Under the Nuclear Safety and Control Act and REGDOC-2.13.1, licensees that hold nuclear material must keep accounts of it, report inventories and changes to the CNSC, which reports to the IAEA, provide information about their facilities and allow IAEA inspectors access. CANDU reactors, which are refuelled on power, present particular safeguards challenges, and the IAEA uses a combination of seals, cameras, bundle counters and inspections to verify fuel movements. Since the mid-2000s the IAEA has drawn the broader conclusion each year that all nuclear material in Canada remained in peaceful activities, which allows it to apply a more efficient, state-level approach.

Nuclear security regulation

The Nuclear Security Regulations set requirements for the physical protection of high-security sites, such as power plants and facilities that hold significant quantities of certain nuclear material, and for the material itself. Licensees must have a security programme approved by the CNSC, protected areas and inner areas with controlled access, security screening of workers, detection and assessment systems, an on-site nuclear response force at high-security sites, and arrangements with off-site police. REGDOC-2.12.3 covers the security of sealed radioactive sources, such as those used in medicine and industry, using a graded approach based on the IAEA's categorization of sources. After the attacks of September 2001 the CNSC issued orders to strengthen security at high-security sites, and the regulations were amended in 2006.

The design basis threat concept

Physical protection requirements in both countries are built around the concept of a design basis threat. The state, using intelligence and threat assessments, defines the attributes and characteristics of potential adversaries, such as insiders or external groups, against which the licensee's physical protection system must be designed and evaluated. Threats beyond the design basis are the responsibility of the state, through its police and military. The design basis threat itself is protected information, and this course does not go into its contents. What matters for an engineer is the principle: the regulator sets a defined threat, the licensee designs and demonstrates a system that protects against it, and the regulator tests that the system works.

Security and safety must be designed together. Barriers that slow an adversary also slow emergency responders. Locked doors in vital areas must open quickly for operators in an emergency. A cyber security control that isolates a digital system must not prevent safety functions from working. Modern designs consider security from the start, an approach often called security by design, which can reduce the need for guards and barriers by placing vital equipment below ground or inside robust structures.

Information security and trustworthiness

Prescribed information under the Act, such as details of security arrangements and some design information, must be protected, and the CNSC holds part of its hearings on security matters in closed session. Workers who need unescorted access to high-security sites must hold a site access security clearance, which involves background, criminal record and other checks, and REGDOC-2.12.2 sets out the requirements. Fitness for duty programmes address alcohol and drug use and fatigue.

Cyber security

Nuclear plants increasingly rely on digital instrumentation and control, and digital systems can be attacked remotely or through infected media and equipment. Cyber security for nuclear facilities therefore aims to protect the digital assets that perform or support safety, security and emergency preparedness functions. The basic approach is defence in depth applied to computer networks: the most important systems are placed in the most protected zones, often with one-way data diodes that let data flow out but nothing flow in, removable media and maintenance laptops are tightly controlled, changes are managed and tested, and staff are trained to recognize threats.

In Canada, the CNSC requires licensees of high-security sites to have a cyber security programme, and it references the CSA Group standard N290.7, Cyber security for nuclear facilities, as the basis for compliance. Licensees identify the digital assets that matter, assign them to protection levels and apply controls in proportion.

Transport and sources

Security does not apply only to fixed facilities. Radioactive material is shipped by road, rail, sea and air, and shipments of certain material need security plans, escorts, tracking and advance notification to authorities. Radioactive sources used in hospitals, universities and industry, such as those in cancer therapy machines, blood irradiators, industrial radiography cameras and well logging tools, also need protection, because a lost or stolen source can cause serious injuries even without any malicious intent. The IAEA's Code of Conduct on the Safety and Security of Radioactive Sources, which both countries support, sets out a graded approach in which the most hazardous sources receive the strongest controls, national registers track them from manufacture to disposal, and imports and exports are controlled.

The CNSC maintains a national sealed source registry and a tracking system for high-risk sources, and requires licensees to report transfers. Several Canadian programmes have replaced high-activity sources with alternatives where possible, such as X-ray irradiators in place of caesium blood irradiators.

Insiders and trustworthiness

Many of the most serious security concerns involve insiders, people with authorized access who might misuse it. Regulators address the insider concept at the framework level through trustworthiness and reliability programmes, the two-person rule for certain sensitive tasks, access controls that limit each worker to the areas needed for their job, behavioural observation by supervisors and colleagues, and a culture in which workers report concerns. Many of these measures also support safety, because they reduce the chance of errors and help detect impairment or stress.

Peer review and international cooperation

Security is a national responsibility, but countries learn from each other. The IAEA's International Physical Protection Advisory Service sends teams of experts, at a state's request, to review its legal and regulatory framework for nuclear security and its practices at selected facilities. Both Canada and the United States have hosted such missions. Between 2010 and 2016 a series of four Nuclear Security Summits brought heads of government together to make commitments, including the removal of highly enriched uranium from many research reactors and facilities around the world and its conversion to low-enriched uranium. Canada, for example, returned highly enriched uranium from its research reactors and isotope production programmes to the United States in the years that followed.

Safeguards and security by design

New reactor designs give an opportunity to build safeguards and security in from the start. Safeguards by design means that the designer works with the regulator and the IAEA early so that the plant includes features that make verification easier, such as places for cameras and seals, measurement points and secure data links, rather than retrofitting them later. Security by design means placing vital equipment where it is easiest to protect, reducing the number of access points and using the plant's structures as barriers, so that fewer guards are needed. For small modular reactors, which may be deployed at remote sites or in large numbers, these approaches may be the key to keeping security costs proportionate. Regulators in both countries have been developing approaches that allow security requirements to be scaled to the hazard of each design, as lesson 9 discusses.

Elena ends the week with a reminder. "An engineer does not need to know the threat to design well for security. You need to know that it exists, that the rules are set for good reasons, and that your design choices can make protection easier or harder. Ask the security team early, and listen to what they tell you."

Hana notices that the security framework follows the same pattern as the safety framework she has studied all term: international principles, national law, regulations, a licence and its conditions, inspection and enforcement. The content is protected, but the structure is the same.