July 14, 2017
In this essay, Mahiro Kikuchi concludes that: “Quantitative and timely evaluation system for detection of protracted theft by insider should be built in the NMAC as an essential part of its function. All people including not only the national competent authority but also top management and staffs at nuclear facilities should take appropriate actions to establish and to maintain the capability to deter and to detect the malicious acts by insider…To act appropriately, the national competent authority and operators of nuclear facilities should share the awareness of the risk about clear and present danger posed by nuclear terrorism.”
Masahiro Kikuchi is Executive Director of the Nuclear Material Control Center, Tokyo. At the time of writing this paper, he was CEO of Kikurin Institute of International Politics and Technology and former Executive Director of the Nuclear Material Control Center.
This Special Report was prepared for the Project on Reducing Risk of Nuclear Terrorism and Spent Fuel Vulnerability In East Asia. It was presented at a Nautilus Institute Workshop at International House, Tokyo, September 14-15, 2015, funded by The Macarthur Foundation.
The views expressed in this report do not necessarily reflect the official policy or position of the Nautilus Institute. Readers should note that Nautilus seeks a diversity of views and opinions on significant topics in order to identify common ground.
Banner Image Credit: from Use of Nuclear Material Accounting and Control for Nuclear Security Purposes at Facilities, Implementing Guide, IAEA, Vienna 2015, here.
II. NAPSNET SPECIAL REPORT BY MASAHIRO KIKUCHI
STRENGTHENING NUCLEAR SECURITY SYSTEM AGAINST INSIDER THEFT OF NUCLEAR MATERIAL
July 14, 2017
1. Historical background
At the dawn of the era of nuclear non-proliferation, the proliferation concerns of nuclear material for non-state actors were recognized and considered as the physical protection of nuclear material and related facilities together with nuclear safeguards.
In the United State, the first nuclear weapon state, two separated policies of non-proliferation were adopted. The first was for international safeguards and the export control of nuclear materials and related sensitive equipment of nuclear technology, in order to prevent proliferation of nuclear weapons or other nuclear explosive devices to other states, that had already possessed nuclear capabilities or had been developing them. The second was the physical protection system for domestic purpose.
In the early stage of development related to non -proliferation measures, the US government recognized that:
“Since both system (international safeguards and domestic safeguards) have as their objective the detection of diversion of material to unauthorized uses, many of the same elements and techniques can and do appear in both system. There are, however, important differences between a control system designed to be applied nationally and one designed to be applied internationally. In the national context there was a strong presumption that the management and the personnel employed in the operation of atomic energy facilities will be guided by national policy and will not divert material from the uses specified by the government. Any attempted diversion, therefore, is most likely to be on a small scale and act of only one or a few people.” 
On the other hand, the IAEA published the document titled: “RECOMMENDATIONS FOR THE PHYSICAL PROTECTION OF NUCLEAR MATERIAL” prior to the development of the first guideline of physical protection named as “THE PHYSICAL PROTECTION OF NUCLEAR MATERIAL (INFICIRC/225)”. The introduction of the recommendation suggested that:
“The physical protection of nuclear material is an essential supplement to the State’s national system of accounting for and control (SSAC) of nuclear material, which have as one of their aims the prevention of diversion of nuclear material.”
The guideline, INFCIRC/225, also described as the objectives as follows;
“The physical protection system should be established to minimize the possibilities for unauthorized removal (including the theft of nuclear materials) of nuclear material or for sabotage.”
From the above mentioned documents, it is easy to understand that the United States as well as the IAEA, from the early stage, recognized the technical measures of safeguards and physical protection of nuclear material were almost similar but purposes of them were different, such as safeguards against the international proliferation and physical protection against the domestic proliferation.
After the end of the cold war, the materials subject to physical protection were reconsidered. In order to prevent significant consequences from possible exposure by radioactive material, which may be dispersed by malicious acts, it was determined that materials with a high level of radioactivity including radioactive isotopes should be included in the subjected materials. The name of the regime was also changed from the physical protection to nuclear security, which covers the wider range, and a new recommendation was published by the IAEA.
The need for protection against the unauthorized removal of the materials by the insiders and the sabotage are clearly identified in the recommendation.
2. Categorization of possible insider acts and previous measure against theft of nuclear material by insider
When we consider the insider threat, we categorize this threat into several possible insider’s acts, for example, the kinds of facilities to be considered such as a facility with high level radioactive material like spent fuel (power reactor) or a facility with significant material to be nuclear explosive devices like Pu and MOX products (MOX fuel fabrication facility) or a facility with both material (reprocessing facility); the kinds of insider threat (sabotage or nuclear theft or aid the outsider in doing sabotage and theft); and the kinds of person who has a possibility to be insider. Additionally, we must consider the operation mode of facility such as under normal operation or periodical maintenance and the real function of physical protection system and its performance which has been already introduced to a facility.
The kinds of person who has a possibility to be insider could be categorized as follows;
- Low-level worker whose jobs would be maintenance in the limited access area and who could not access protected area,
- Medium level worker or facility operator whose jobs would be a kind of operation or maintenance in the protected area, and
- High-level facility operator who can access a vital area.
The first categorized person may not have high-level technical knowledge of nuclear facility and may include outside contract employee. The second categorized person may have high-level technical knowledge of nuclear facility and knows access route to vital area. The third categorized person has high-level technical knowledge of nuclear facility and can access main operation system and nuclear materials in the facility.
Each insider could aid an external adversary to undertake armed sabotage. If medium- and high- level insider would undertake sabotage in protected area or vital area, they may conduct illegal operations of equipment or system which could lead to high radiological consequences without armed sabotage, because they might not be possible to bring arms into each area by checking of entrance gate to each area.
There are two typical scenarios related to the theft of nuclear materials. The first is the theft of subject materials by the outsider who may intrude from outside of nuclear facilities. The second is the theft of subject material by insider including high-level facility operator and outside contractors who can access in the area of nuclear material existed.
The former scenario can be used for the physical protection against intrusion of outsiders. After success of intrusion, possible malicious acts could be categorized to the sabotage of the facility equipment and facility itself and the unauthorized removals including the theft of subjected material.
The discussion in this paper is focused on strengthening of the protection against theft of nuclear material by insider as proposed measures for the latter scenario.
Measures against insiders which have been currently introduced are structural, for examples, security clearance of employee and outside contractors who can access in the area of nuclear material existed and the introduction of the two-person rule to watch the each other’s activities in the vital area.
It is an obvious that while such structural measures would be effective against outsiders, these measures could not provide sufficient technical credibility against insider’s malicious acts. All person who can access the vital area might have a possibility to be an insider if they are subject to pressures such as their family being taken hostage by terrorists who threaten their lives. Therefore, effective technical measures with objective credibility against insider’s threat including theft of nuclear material should be established.
3. Use of nuclear material accountancy system
It has been internationally recognized that the material accountancy system is a safeguards measure of fundamental importance, with containment and surveillance as important complementary measures. However, as mentioned above, from the dawn of nuclear development, material accountancy has been used as an effective measure for nuclear material control.
At the very early stage, the United States introduced the design concepts of the MPC&A (material protection, control and account) with corresponding growth of the US nuclear activities, both military and commercial. Under such concepts, civilian nuclear operators in the United States have been regulated in conformity to national regulations. Currently, the US NNSA is working with international partners for promoting the MPC&A program as the first line of the defense in order to prevent nuclear terrorism by securing and eliminating potentially vulnerable nuclear weapons and weapons -usable material. The MPC&A program is considered as a key defense measure against nuclear theft and terrorism and helps to develop a robust, comprehensive, and domestically sustainable MPC&A infrastructure. The MPC&A Program emphasizes continuous improvements in physical protection system, protective forces, material control and accounting, nuclear security culture, and creating an infrastructure that supports these programs.
On the other hand, as a technical construct, the nuclear material accountancy system offers utility beyond nuclear non -proliferation. Nuclear material measurement is an important measure to determine the amount of nuclear material of each stage in processes, for example, receipt, shipment, inventories and holdup. The material accountancy based on the material balance with measurement is a valuable control measure of nuclear material. The accountancy results under high accurate quality control based on the measurement can be used as promising tool for operator’s purpose to ensure the nuclear safety, including criticality control of nuclear material by monitoring amount of holdup, property control in accordance with customer’s requirement, and the environmental preservation. In order to progress the peaceful nuclear activities and to gain public acceptance for nuclear use, it is necessary to introduce and to maintain material accountancy system with an accurate and precise measurement system.
There was a good example that showed that the material accountancy system could detect material leak in the process of THORP in UK. Long period monitoring about shipper/receiver differences (SRDs) as a part of material accountancy revealed the Pu solution leakage from dissolver. That indicates as one of practical evidence that the material accountancy measure could be used as a material control tool for safety assurance.
4. Roles and usefulness of IAEA NMCA guideline
The IAEA published new guidelines on the Nuclear Material Accounting and Control (NMAC) for nuclear security. The document focuses on measures to prevent and to mitigate the risk posed by insider threats with identifying elements of functions that must be implemented at a nuclear facility level. An NMAC system is expected the timely detection of unauthorized removal of nuclear material by maintaining an inventory of all nuclear material, including information related to its location. The guide shows that the NMAC system should provide information on the isotopic composition, quantity, type of nuclear material, location in residence in the process, use and occasion of movement.
Physical protection system did not require the quantitative information of nuclear material, but the NMAC needs the quantitative function by the material measurement and accountancy for nuclear security purpose. This is the important difference point from physical protection of nuclear material.
An effective NMAC system is expected to be capable of detecting malicious insider activities such as thefts of small amount of nuclear material (protracted thefts) and to support the correct assessment by the operator to preclude irregular facility operation. These design concepts had already introduced in US domestic safeguards system before the IAEA NMAC guideline.
The important features of the NMAC are the separation of the functions of control and accounting. The accounting function should need to obtain accurate, timely, complete and reliable quantitative information on material inventories, their location and characteristics of materials. On the other hand, the control function should seek to maintain the continuity of knowledge, thereby enhancing function to deter and to detect unauthorized removals of nuclear material. In the control function, the conventional physical protection system could be included. An effective combination of the two functions under parallel operation will be expected to achieve quantitative and timely detection of insider’s theft.
The NMAC must efficiently detect unauthorized removal rapidly enough to enable a timely response to recover the missing nuclear materials. It is generally understood that in order to achieve the timely detection, frequent physical inventory taking (PIT) in the material balance areas (MBAs) will be essential activity to obtain the quantitative indicator, for example, Material Unaccounted For (MUF) or Book/Physical Inventory Difference (BPID). The PIT could confirm physical existence of nuclear material in the MBA, and the value of MUF indicates difference between book inventory and physical inventory. Book inventory shows accounted values based on the material flow measurement system. Physical inventory is taken by physical measurement or derived estimates of process inventory. Even though there may be several uncertainties related to each measurement and estimation, theoretically, the value of MUF could indicate missing materials or unmeasured nuclear material in the process quantitatively.
The level of uncertainty could be improved in accordance with the state of the art of this system. However, the frequency of PIT is not mentioned clearly in the guide of the NMAC. The guide not only states that: “Physical inventory taking may not always ensure the timely detection of unauthorized removal of nuclear material.”
The guide also suggests other candidate measures, such as the item monitoring and monitoring nuclear material during processing, to achieve timely detection of unauthorized removals. And the guide expects that “these measures could significantly reduce the number of successful malicious insider scenarios and could assist in detection of unauthorized removal of nuclear material [and] could mitigate some abrupt theft scenarios, reduce possible nuclear material quantities involved in the event of protracted theft, and therefore increase the completion time for some scenarios. ”
It is true that these measures could be promising tools to indicate an alarm of unusual event which may be a result from unauthorized removal of nuclear material, but it should be recognized that the function of these measures has some vulnerability relevant to the amount of unauthorized removed nuclear material.
5. Further strengthening areas against insider’s theft
A. Introduction of “NRTA-wise” system to nuclear security
Introduction of an advanced material accountancy and control system similar to the near real-time material accountancy (NRTA) system could be recommended as a strengthening point for timely detection of the theft of unauthorized removal of nuclear material.
The original NRTA is defined in the Code of Federal Regulation in the US government as follows:
“The NRTA as a method of accounting for the location, quantity, and disposition of special fissionable material at facilities that store or process such material, in which verification of peaceful use is continuously achieved by means of frequent physical inventories and the use of in -process instrumentation.
Also the IAEA defined the NRTA as follows:
“A form of nuclear material accountancy for bulk handling material balance areas in which itemized inventory and inventory change data are maintained by the facility operator and made available to the IAEA on a near real time basis so that inventory verification can be carried out and material balances can be closed more frequently than, for example, at the time of an annual physical inventory taking by the facility operator. When the in-process inventory cannot be determined by measurement, NRTA requires that an estimate, including its uncertainty, be made of the inventory in each equipment item, on the basis of adequately documented techniques.”
Currently the NRTA system has been introduced for international safeguards purpose at several plutonium bulk handling facilities in Japan. Features of the NRTA system are to improve a detection capability to achieve quantitative and timely goal of safeguards requirement, simultaneously. The technical concepts and measures have a possibility of being extended to support nuclear security.
The NRTA has a long history to develop its concept and measures from 1970s. In early stage of development in the United States, the name of the DYMAC (Dynamic material accountancy and control) and the RETIMAC (Real time material accountancy and control), which were the original models of the NRTA, were developed for a domestic safeguards system as one part of MPC&A. Because DYMAC and RETIMAC adopted the system concept that was real time or near real time treatments of material measurement information, the development of technologies named the NRTA has been progressing as a measure of international safeguards in order to achieve the timeliness goal for significant nuclear material such as plutonium and mixed oxide material.
It could be proposed, as a kind of renaissance, to introduce NRTA wise system which has capabilities to achieve quantitative decision of protracted unauthorized removal in timely manner for the nuclear security. The numbers and size of MBAs for NRTA wise system could be assigned as smaller and more process specific area than safeguards MBAs in order to increase detection capability for protracted unauthorized removal in accordance with threat scenarios and their levels which have been confronted . Practical frequent PIT similar to safeguards purpose, which permits an estimation method and technique for unmeasured in -process inventory with its uncertainty, could be introduced.
B. Enhancing the responsibility of the national competent authority
i. Enhancing the national inspection regime
The guide required oversight which should include periodic inspections and evaluations of the facility’s NMAC system’s contribution to meeting the nuclear security objectives of the facility.
The national system, which has a capability of physical verification of nuclear existence in process of facilities for meeting national safeguards requirements, could be extended for use for nuclear security by quantitatively verifying the existence of nuclear material. In case of Japan, theJapan Safeguards Office of the Nuclear Regulation Authority as well as the designed organization for national safeguards inspection (Nuclear Material Control Center) have been carrying out safeguards inspections at the nuclear facilities as well as location outside facilities (LOFs) where nuclear materials are located, to ensure the operator’s compliance with the national regulations which also comply with international agreements. National safeguards inspectors can access almost all nuclear materials in these facilities and LOFs periodically and confirm the existence of them against facility’s declaration that is based on the operator’s accountancy system. As the operator’s accountancy system could be assigned as an accountancy function of NMAC, the national inspection regime for safeguards could be used as the nuclear security purpose.
ii. Enhancing establishment procedures for design criteria and performance requirement for NMAC
The design criteria and performance requirements for a NMAC system should be defined by the national competent authority in the overall context of nuclear security taking into account the design base threat (DBT). The design criteria and performance requirements are especially useful to assess the effectiveness of the nuclear security system against an insider threat. The design criteria should suggest the definition of amount of nuclear material which would indicate minimum amount of removed material through unauthorized means, and a timeframe which would indicate the maximum time that may elapse between theft of given amount of nuclear material and detection of the theft by the NMAC.
In case of the international safeguards system, the quantity goal refers to the approximate amount of nuclear material for which the possibility of manufacturing a nuclear explosive device cannot be excluded, and timeliness goal refers to the conversion time which indicates the minimum time to convert form of nuclear material to the metallic component. The IAEA safeguards clearly counters concerns about manufacturing of a nuclear explosive device.
However, in case of NMAC system, the design criteria and performance requirements should take into account adversary scenarios based on the DBT and of consequence, that is, the levels of harm caused by the theft material. Therefore, the design criteria and performance requirements would be varied according to the situation of a state’s security concerns. In order to suggest design criteria and performance requirement to the facility operator with accurate and timely bases, the national competent authority should always keep an update of the state concerns and adversary scenarios relevant to the security situations.
iii. Enhancing awareness of the responsibilities of all people related nuclear security including top management of the operators
Maintaining awareness of all people related to nuclear security including top management at the facility is needed. In order to establish the NMAC and to perform best practice of its function, certain management system of NMAC should be maintained by applying the quality control system, such as ISO-9001 of quality control, ISO-14001 of environment management, ISO -31000 of risk management, and ISO-50001 of energy management.
The top management should be assigned as NMAC manager and should be always aware of and provide oversight of any activities relevant to NMAC system. If the necessity of the improvement is recognized, he/she should take the appropriate actions in a timely manner under his/her responsibility.
For all staff engaged in the NMAC, awareness of the nuclear security situation should be maintained for effective and efficient security system at the facility. This awareness is called as the nuclear security culture at the facility level. Trainings are one of the important measures for maintaining the security culture.
Quantitative and timely evaluation system for detection of protracted theft by insider should be built in the NMAC as an essential part of its function.
All people including not only the national competent authority but also top management and staff at nuclear facilities should take appropriate actions to establish and to maintain the capability to deter and to detect the malicious acts by insider.
To act appropriately, the national competent authority and operators of nuclear facilities should share the awareness of the risk about clear and present danger posed by nuclear terrorism.
 Myron B. Kratzer, “Safeguards: Their Purpose, Principles, and Practice”, 7th Annual Meeting of INMM, June 1966, pp.25 -26.
 “RECOMMENDATIONS FOR THE PHYSICAL PROTECTION OF NUCLEAR MATERIAL”, produced by a panel of experts working under IAEA sponsorship in Vienna 6 -10 March 1972.
 “THE PHYSICAL PROTECTION OF NUCLEAR MATERIAL (INFCIRC/225)”, Printed by the IAEA, September 1975
 “Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision5)”, IAEA Nuclear Security Series No.13, 2011
Article 29 of “THE STRUCURE AND CONTENT OF AGREEMENTS BETWEEN THE AGENCY AND STATES REQUIRED IN CONNECTION WITH THE TREATY ON THE NON -PROLIFERATION OF NUCLEAE WEAPONS (INFC IRC/153(Corrected)”, June 1972
 G. Weisz, Director Office of Safeguards and Security Department of Energy, “THE COMPLEMENTTARY ASPECT OF U.S. DOMESTIC SAFEGUARDS AND IAEA SAFEGUARDS”, 1st Annual Symposium on Safeguards and Nuclear Material Management, April 1979. In the paper, Weisz stated that “the United States has greatly improved the performance of its system of domestic safeguards to protect, control and account for nuclear material.”
 Material Protection, Control, and Accounting Program, NNSA Fact sheet, http://nnsa.energy.gov/mediaroom/factsheets/protectioncontrolaccounting
 Masahiro KIKUCHI, et.al, “Topical Understandings on Nuclear Material Measurement – Accountancy and Quality Assurance”, 23rd INMM Japan chapter Annual conference, 2002
 Report of the investigation into the leak of dissolver product liquor at the thermal Oxide Reprocessing Plant (THORP) Sellafield notified to HSE on 20 April 2005 http://www.onr.org.uk/periodic-safety-review/thorpreport.pdf
 Use of Nuclear Material Accounting and Control for Nuclear Security Purposes at Facilities Implementing Guide, IAEA Nuclear Security Series No.25 -G, 2015
 US Code of Federal Regulation 22 §6324
 Para.6.3 of IAEA SAFEGUARDS GLOSSARY 2001 Edition, International Nuclear Verification Series No.3
 Para.3.13 ad 3.14 of Para.6.3 of IAEA SAFEGUARDS GLOSSARY 2001 Edition, International Nuclear Verification Series No.3
IV. NAUTILUS INVITES YOUR RESPONSE
The Nautilus Asia Peace and Security Network invites your responses to this report. Please send responses to: firstname.lastname@example.org. Responses will be considered for redistribution to the network only if they include the author’s name, affiliation, and explicit consent.