Security and safeguards

Hana's week on security and safeguards begins with a briefing she is not allowed to take notes in. Afterwards Elena explains why. "Most of what a licensee does on security is protected information, and rightly so. But the framework is public: the treaties, the laws, the regulations, the principles. That is what you need to understand as an engineer. You will design systems that security depends on, and you need to know what the rules are trying to achieve, even if you never see the threat assessment." This lesson stays at that public level.

Safety, security and safeguards

Nuclear regulators often speak of three S's. Safety is about preventing accidents and protecting people and the environment from radiation. Security is about preventing, detecting and responding to malicious acts, such as theft of nuclear material or sabotage of a facility. Safeguards are measures by which the International Atomic Energy Agency verifies that a state is using nuclear material only for peaceful purposes, as it has promised under international agreements. The three are distinct but overlap. A security measure such as limiting access to vital areas can complicate an emergency response, so safety and security requirements must be designed together. Material accountancy serves both security and safeguards.

The international framework

The legal basis for safeguards is the Treaty on the Non-Proliferation of Nuclear Weapons, which entered into force in 1970. Under it, non-nuclear-weapon states agree not to acquire nuclear weapons and to accept IAEA safeguards on all their nuclear material, through a comprehensive safeguards agreement based on the model in IAEA document INFCIRC/153. The 1997 model Additional Protocol, INFCIRC/540, gives the IAEA broader access to information and locations, so that it can verify not only that declared material is not diverted but also that there is no undeclared material or activity. Nuclear-weapon states under the treaty, including the United States, have voluntary offer agreements that let the IAEA apply safeguards at some of their civilian facilities.

Nuclear security has its own instruments. The Convention on the Physical Protection of Nuclear Material, which entered into force in 1987, originally covered nuclear material in international transport; its 2005 amendment, in force since 2016, extended it to domestic use, storage and transport and to the protection of facilities against sabotage. The International Convention for the Suppression of Acts of Nuclear Terrorism entered into force in 2007. UN Security Council Resolution 1540 of 2004 requires all states to adopt controls against the spread of weapons of mass destruction to non-state actors. The IAEA publishes non-binding guidance in its Nuclear Security Series, the best known being its recommendations on physical protection of nuclear material and facilities, often cited as INFCIRC/225/Revision 5. Export controls are coordinated through the Nuclear Suppliers Group, whose guidelines both countries apply.

# Timeline of major public instruments in nuclear safeguards and security.
events = [
    (1957, "IAEA established"),
    (1970, "Non-Proliferation Treaty enters into force"),
    (1972, "comprehensive safeguards model (INFCIRC/153)"),
    (1987, "physical protection convention enters into force"),
    (1997, "Additional Protocol model (INFCIRC/540)"),
    (2004, "UN Security Council Resolution 1540"),
    (2007, "nuclear terrorism convention enters into force"),
    (2011, "physical protection recommendations, revision 5"),
    (2016, "amended physical protection convention enters into force"),
]
prev = None
for year, what in events:
    gap = f"(+{year - prev} y)" if prev else ""
    print(f"{year} {gap:8s} {what}")
    prev = year
gaps = [b[0] - a[0] for a, b in zip(events, events[1:])]
print(f"span {events[-1][0] - events[0][0]} years, mean gap {sum(gaps)/len(gaps):.1f} years, longest gap {max(gaps)} years")

1957          IAEA established
1970 (+13 y)  Non-Proliferation Treaty enters into force
1972 (+2 y)   comprehensive safeguards model (INFCIRC/153)
1987 (+15 y)  physical protection convention enters into force
1997 (+10 y)  Additional Protocol model (INFCIRC/540)
2004 (+7 y)   UN Security Council Resolution 1540
2007 (+3 y)   nuclear terrorism convention enters into force
2011 (+4 y)   physical protection recommendations, revision 5
2016 (+5 y)   amended physical protection convention enters into force
span 59 years, mean gap 7.4 years, longest gap 15 years

The timeline shows how the regime grew in layers, often after events exposed gaps. The Additional Protocol followed the discovery in the early 1990s of an undeclared weapons program in a state with a comprehensive safeguards agreement. The amendment to the physical protection convention and Resolution 1540 followed the attacks of September 2001, which changed how every country thought about the threat to nuclear facilities.

Safeguards in the United States

As a nuclear-weapon state under the treaty, the United States is not required to accept safeguards, but it has a voluntary offer agreement with the IAEA, in force since 1980, under which it lists civilian facilities that are eligible for safeguards, and the IAEA chooses which to inspect. An Additional Protocol entered into force in 2009, with exclusions for activities of direct national security significance. The NRC implements these agreements for its licensees through 10 CFR Part 75, while 10 CFR Part 74 sets domestic requirements for material control and accounting. The Department of Energy handles its own facilities. US policy has long supported the IAEA's safeguards system financially and technically, as a pillar of the non-proliferation regime.

Physical protection regulation

10 CFR Part 73 sets requirements for physical protection of plants and materials. Power reactor licensees must protect against a design basis threat, maintain protected and vital areas with controlled access, screen workers through background checks and a fitness-for-duty program, operate detection and assessment systems, and keep an armed security force on site, with arrangements with local, state and federal law enforcement. After the attacks of September 2001 the NRC issued orders that raised security requirements, then codified them in a 2007 rule revising the design basis threat and a 2009 rule on power reactor security. Since 2009, 10 CFR 73.54 has required cyber security programs. The NRC also conducts force-on-force inspections at each plant about every three years, in which a trained adversary team tests the plant's security response under controlled conditions.

The design basis threat concept

Physical protection requirements in both countries are built around the concept of a design basis threat. The state, using intelligence and threat assessments, defines the attributes and characteristics of potential adversaries, such as insiders or external groups, against which the licensee's physical protection system must be designed and evaluated. Threats beyond the design basis are the responsibility of the state, through its police and military. The design basis threat itself is protected information, and this course does not go into its contents. What matters for an engineer is the principle: the regulator sets a defined threat, the licensee designs and demonstrates a system that protects against it, and the regulator tests that the system works.

Security and safety must be designed together. Barriers that slow an adversary also slow emergency responders. Locked doors in vital areas must open quickly for operators in an emergency. A cyber security control that isolates a digital system must not prevent safety functions from working. Modern designs consider security from the start, an approach often called security by design, which can reduce the need for guards and barriers by placing vital equipment below ground or inside robust structures.

Information security and trustworthiness

Safeguards information, a category defined in the Atomic Energy Act and protected under 10 CFR 73.21, covers details of physical protection, and the NRC withholds it from public release. Workers who need unescorted access must pass an access authorization program under 10 CFR 73.56 that includes background checks, psychological assessment and behavioral observation, and a fitness-for-duty program under Part 26 addresses drugs, alcohol and fatigue.

Cyber security

Nuclear plants increasingly rely on digital instrumentation and control, and digital systems can be attacked remotely or through infected media and equipment. Cyber security for nuclear facilities therefore aims to protect the digital assets that perform or support safety, security and emergency preparedness functions. The basic approach is defense in depth applied to computer networks: the most important systems are placed in the most protected zones, often with one-way data diodes that let data flow out but nothing flow in, removable media and maintenance laptops are tightly controlled, changes are managed and tested, and staff are trained to recognize threats.

In the United States, 10 CFR 73.54 requires power reactor licensees to protect digital computer and communication systems associated with safety, security, emergency preparedness and support systems from cyber attacks. Licensees implemented their programs in stages over several years, and the NRC inspects them as part of the reactor oversight process. Regulatory Guide 5.71 describes an acceptable approach.

Transport and sources

Security does not apply only to fixed facilities. Radioactive material is shipped by road, rail, sea and air, and shipments of certain material need security plans, escorts, tracking and advance notification to authorities. Radioactive sources used in hospitals, universities and industry, such as those in cancer therapy machines, blood irradiators, industrial radiography cameras and well logging tools, also need protection, because a lost or stolen source can cause serious injuries even without any malicious intent. The IAEA's Code of Conduct on the Safety and Security of Radioactive Sources, which both countries support, sets out a graded approach in which the most hazardous sources receive the strongest controls, national registers track them from manufacture to disposal, and imports and exports are controlled.

The NRC and the Agreement States track high-risk sources through the National Source Tracking System, and Part 37 sets security requirements for category 1 and 2 quantities of radioactive material. Federal programs have helped hospitals replace cesium blood irradiators with X-ray units, removing a category of high-activity source entirely.

Insiders and trustworthiness

Many of the most serious security concerns involve insiders, people with authorized access who might misuse it. Regulators address the insider concept at the framework level through trustworthiness and reliability programs, the two-person rule for certain sensitive tasks, access controls that limit each worker to the areas needed for their job, behavioral observation by supervisors and colleagues, and a culture in which workers report concerns. Many of these measures also support safety, because they reduce the chance of errors and help detect impairment or stress.

Peer review and international cooperation

Security is a national responsibility, but countries learn from each other. The IAEA's International Physical Protection Advisory Service sends teams of experts, at a state's request, to review its legal and regulatory framework for nuclear security and its practices at selected facilities. Both Canada and the United States have hosted such missions. Between 2010 and 2016 a series of four Nuclear Security Summits brought heads of government together to make commitments, including the removal of highly enriched uranium from many research reactors and facilities around the world and its conversion to low-enriched uranium. Canada, for example, returned highly enriched uranium from its research reactors and isotope production programs to the United States in the years that followed.

Safeguards and security by design

New reactor designs give an opportunity to build safeguards and security in from the start. Safeguards by design means that the designer works with the regulator and the IAEA early so that the plant includes features that make verification easier, such as places for cameras and seals, measurement points and secure data links, rather than retrofitting them later. Security by design means placing vital equipment where it is easiest to protect, reducing the number of access points and using the plant's structures as barriers, so that fewer guards are needed. For small modular reactors, which may be deployed at remote sites or in large numbers, these approaches may be the key to keeping security costs proportionate. Regulators in both countries have been developing approaches that allow security requirements to be scaled to the hazard of each design, as lesson 9 discusses.

Elena ends the week with a reminder. "An engineer does not need to know the threat to design well for security. You need to know that it exists, that the rules are set for good reasons, and that your design choices can make protection easier or harder. Ask the security team early, and listen to what they tell you."

Hana notices that the security framework follows the same pattern as the safety framework she has studied all term: international principles, national law, regulations, a license and its conditions, inspection and enforcement. The content is protected, but the structure is the same.