3,227
Views
1
CrossRef citations to date
0
Altmetric
Articles

Exploring the human dimension of nuclear security: the history, theory, and practice of security culture

 

ABSTRACT

Over the past two decades, the international community has devoted considerable attention to the human dimension of nuclear security. This trend is part of a more holistic approach to securing nuclear facilities, grounded in the concept of culture, that moves beyond the traditional focus of physical-protection measures. But what explains this shift and what does it entail? This article begins by demonstrating, through a series of real-life case studies, the potential for human factors to undermine nuclear-security systems. It then considers the rise and consolidation of “culture” as a concept used to better understand and organize international efforts to strengthen nuclear security. Nuclear-security culture is then explored in practice, drawing on a review of relevant initiatives as well as empirical research conducted by the authors at several UK nuclear sites. A number of likely challenges for developing an effective nuclear-security culture at the operational level are discussed, as is the value of the culture-focused guidance developed by the International Atomic Energy Agency. The article concludes that while nuclear-security culture has been widely promoted at the international level, there exists considerable scope for new initiatives to further strengthen engagement at the working level of industry.

Acknowledgments

The authors are grateful to Paul Tonks, head of security and resilience at the UK Nuclear Decommissioning Authority, for sharing his expertise and insights and for his help in facilitating the UK-based interviews, as well as to the reviewers and editor for their helpful comments and suggestions.

Notes

1 William Tobey, “Planning for Success at the 2014 Nuclear Security Summit,” Stanley Foundation, December 2013, p. 5, <https://stanleycenter.org/wp-content/uploads/2019/09/TobeyPAB1213a.pdf>.

2 Matthew Bunn, “Reducing the greatest risks of nuclear theft and terrorism,” Daedalus, Vol. 138, No. 4 (Fall 2009), p. 116.

3 Centre for the Protection of National Infrastructure, “Personnel and People Security,” last updated August 9, 2021, <https://www.cpni.gov.uk/personnel-and-people-security>; International Atomic Energy Agency (IAEA), Preventative and Protective Measures Against Insider Threats: Implementing Guide, IAEA Nuclear Security Series No. 8-G (Rev. 1) (Vienna: International Atomic Energy Agency, 2008), < https://www-pub.iaea.org/MTCD/Publications/PDF/PUB1858_web.pdf>.

4 (UK) Office for Nuclear Regulation, “Security Assessment Principles for the Civil Nuclear Industry,” 2017, pp. 53–54, <http://www.onr.org.uk/syaps/security-assessment-principles-2017.pdf>.

5 White House, Office of the Press Secretary, “Key Facts About the Nuclear Security Summits,” April 13, 2010, <https://obamawhitehouse.archives.gov/the-press-office/key-facts-about-nuclear-security-summit>.

6 State commitments included establishing new “Centers of Excellence” for nuclear-security education and training, inviting international reviews of their nuclear-security systems, and launching security-culture self-assessments.

7 This study was undertaken by the authors from July 2017 to April 2018 in support of a broader exercise to assess security culture within nuclear organizations managed by the NDA.

8 National Consortium for the Study of Terrorism and Responses to Terrorism, “Nuclear Facilities Attack Database,” n.d., <https://www.start.umd.edu/nuclear-facilities-attack-database-nufad>.

9 Mary Lynn Garcia, “Introduction to Vulnerability Assessment,” in Lawrence J. Fennelly, ed., Effective Physical Security, 4th ed. (Waltham, MA: Butterworth-Heinemann, 2013), p. 21.

10 IAEA, “Nuclear Security Recommendations on the Physical Protection of Nuclear Material and Facilities,” INFCIRC/225/Revision 5, Jan. 2011, pp. 58-59, <https://www-pub.iaea.org/MTCD/Publications/PDF/Pub1481_web.pdf>.

11 For a detailed overview of this incident, see Jeffrey T. Richardson, Defusing Armageddon: Inside NEST, America’s Secret Nuclear Bomb Squad (New York: Norton Press, 2009), pp. 37–42.

12 US Nuclear Regulatory Commission (NRC), “Attempted Extortion: Low Enriched Uranium,” IE Circular No. 79-08, May 18, 1979 (page last reviewed/updated March 25, 2021), p. 2, <https://www.nrc.gov/reading-rm/doc-collections/gen-comm/circulars/1979/cr79008.html>.

13 US NRC, “Attempted Extortion,” p. 2.

14 Richardson, Defusing Armageddon, pp. 41–42.

15 David Beresford, Truth is a Strange Fruit: A Personal Journey Through the Apartheid War (Johannesburg: Jacana Media, 2010), p. 105.

16 Jo-Ansie van Wyk, “Nuclear terrorism in Africa: The ANC’s Operation Mac and the attack on the Koeberg Nuclear Power Station in South Africa,” Historia, Vol. 60, No. 2 (November 2015), p. 53, <http://dx.doi.org/10.17159/2309-8392/2015/V60N2A3>.

17 This had become clear following the earlier theft of site plans for the plant by Renfrew Christie, who had been jailed in 1979 for handing these over to the ANC. Stuart Murray, Koeberg: Eskom’s Nuclear Success Story (Rondebosch, South Africa: Churchill Murray Publications, 1994).

18 Murray, Koeberg.

19 Murray, p. 73.

20 Eric Schlosser, “Break-in at Y-12,” New Yorker, March 2, 2015, <https://www.newyorker.com/magazine/2015/03/09/break-in-at-y-12>.

21 Y-12 National Security Complex, “Highly Enriched Uranium Materials Facility,” US Department of Energy (DoE), n.d., <https://www.y12.doe.gov/about/transforming-y-12/highly-enriched-uranium-materials-facility>.

22 US House, Committee on Armed Services, “Nuclear Security: Actions, Accountability and Reform,” hearing before the Subcommittee on Strategic Forces of the Committee on Armed Services, 113th Congress, 1stSession, H.A.S.C. No. 113-13, February 28, 2013, p. 5, <https://www.govinfo.gov/content/pkg/CHRG-113hhrg79996/pdf/CHRG-113hhrg79996.pdf>.

23 US House, Committee on Armed Services, “Nuclear Security,” p. 2.

24 US House, Committee on Armed Services, “Nuclear Security,” pp. 2–3; US DoE, Office of Inspector General, “Special Report: Inquiry into the Security Breach at the National Nuclear Security Administration's Y-12 National Security Complex,” DOE/IG-0868, August 2012, p. 7, <https://www.energy.gov/sites/prod/files/IG-0868_0.pdf >; US House, Committee on Armed Services, “Y-12 Intrusion: Investigation, Response, and Accountability,” hearing before the Subcommittee on Strategic Forces of the Committee on Armed Services, 112th Congress, 2nd Session, H.A.S.C. No. 112–156, September 13, 2013, p. 26.

25 US House, Committee on Armed Services, “Y-12 Intrusion,” p. 3.

26 DoE, Office of Inspector General, “Special Report,” p. 2.

27 DoE, Office of Inspector General, “Special Report,” p. 4.

28 US House, Committee on Armed Services, “Y-12 Intrusion,” p. 26.

29 Dan Zak, “The Prophets of Oak Ridge,” Washington Post, April 30, 2013, <https://www.washingtonpost.com/sf/wp-style/2013/09/13/the-prophets-of-oak-ridge>.

30 Sarah Mullen, “Generic Adversary Characteristics and the Potential Insider Threat to Licensed Nuclear Activities from Insiders,” US NRC, AP-POO3 374, 1981, p. 103, < https://www.hsdl.org/?view&did=11606>.

31 [Johannesburg] Sunday Times, “The Swordsman and the Bomb,” August 29, 2010, <https://www.pressreader.com/south-africa/sunday-times-1107/20100829/281719790897078>.

32 Wilmington Morning Star, “Dale gets 15 Years for Uranium Plot,” May 9, 1979, p. 2.

33 Matthew Bunn and Scott D. Sagan, “A Worst Practices Guide to Insider Threats,” in Matthew Bunn and Scott Sagan, eds., Insider Threats (Ithaca, NY: Cornell University Press, 2016), p. 153.

34 A. D. Swain and H. E. Guttmann, “Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications: Final Report,” Sandia National Laboratories (for the US NRC), NUREG/CR- 1278, August 1983, p. 3, <https://www.nrc.gov/docs/ML0712/ML071210299.pdf>.

35 Thomas B. Sheridan, “Forty-five Years of Man–Machine Systems: History and Trends,” IFAC [International Federation of Automatic Control], Proceedings Volumes, Vol. 18, No. 10 (September 1985), p. 1, <doi.org/10.1016/S1474-6670(17)60193-9>.

36 Thomas B. Sheridan, “Risk, Human Error, and System Resilience: Fundamental Ideas,” Human Factors: The Journal of the Human Factors and Ergonomics Society, Vol. 50, No. 3 (June 2008), p. 418, <doi.org/10.1518/001872008X250773>.

37 Mitchell Rogovin and George T. Frampton, “Three Mile Island: A Report to the Commissioners and to the Public,” Vol. 1, Special Inquiry Group, US NRC, 1980, p. 122, <https://www.osti.gov/servlets/purl/5395798>.

38 President’s Commission on the Accident at TMI [Three Mile Island], (John G. Kemeny, chairman), Report of the President’s Commission on the Accident at Three Mile Island: The Need for Change: The Legacy of TMI, October 1979, p. 2 (emphasis added), <http://large.stanford.edu/courses/2012/ph241/tran1/docs/188.pdf>.

39 President’s Commission on the Accident at TMI, “Report of the President’s Commission,” p. 9.

40 International Nuclear Safety Advisor Group (INSAG), Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident - Safety Series No.75-INSAG-1 (Vienna: International Atomic Energy Agency, 1986), p.76.

41 INSAG, p. 9 (emphasis added).

42 INSAG, Summary Report, p. 76.

43 Terry Kuykendall and Igor Khripunov, with Jason Lowe, “Harmonizing Nuclear Safety Culture and Security Culture: Final Report on the Proceedings of the International Workshop in Serpong, Indonesia, 29-31 January 2018,” Center for International Trade and Security, June 2018, p. 4, <https://www.researchgate.net/profile/Igor-Khripunov/publication/325908800_Harmonizing_Safety_and_Security_Culture_at_Nuclear_Facilities_Report_on_the_International_Workshop/links/5b2c12174585150d23c1a948/Harmonizing-Safety-and-Security-Culture-at-Nuclear-Facilities-Report-on-the-International-Workshop.pdf>.

44 William H. Sewell, Jr., “The Concept(s) of Culture,” in Gabrielle M. Spiegel, ed., Practicing History: New Directions in Historical Writing after the Linguistic Turn (London: Routledge, 2004), p. 77.

45 Sewell, “The Concept(s) of Culture,” p. 77.

46 Susan Wright, “The politicization of culture,” Anthropology Today, Vol. 14, No. 1 (February 1998), p. 11, <http://ruraleconomics.fib.ugm.ac.id/wp-content/uploads/Susan-Wright-The-Politicisation-of-Culture.pdf>.

47 IAEA, “Regulatory Oversight of Safety Culture in Nuclear Installations,” IAEA-TECDOC-1707 (Vienna: International Atomic Energy Agency, 2013), p. 3, <https://www-pub.iaea.org/MTCD/Publications/PDF/TE_1707_CD/PDF/TECDOC_1707.pdf>.

48 IAEA, “Nuclear Verification and Security of Material. Physical Protection Objectives and Fundamental Principles,” GOV/2001/41, August 15, 2001. The document is an attachment to IAEA Board of Governors, “Measures to Improve the Security of Nuclear Materials and Other Radioactive Materials,” GC(45)/INF/14, September 14, 2001, <https://www.iaea.org/sites/default/files/gc/gc45inf-14_en.pdf>.

49 IAEA, “Nuclear Verification,” Attachment C, p. 1.

50 IAEA, “Nuclear Verification,” Attachment C, p. 3.

51 Nuclear-security culture was also the focus of considerable state-level effort during this period, particularly in the United States, but development of the concept in the context of the IAEA arguably gives a better insight into its broader, international evolution over time.

52 IAEA, “Code of Conduct on the Safety and Security of Radioactive Sources,” IAEA/CODEOC/2004, 2004, p. 117, <https://www-pub.iaea.org/MTCD/publications/PDF/Code-2004_web.pdf>.

53 IAEA, “Nuclear Security: Global Directions for the Future,” proceedings of an international conference, London, 16–18 March 2005, <https://www-pub.iaea.org/MTCD/Publications/PDF/Pub1232_web.pdf>.

54 IAEA, “Nuclear Security,” p. 99.

55 The amendment to the CPPNM entered into force in 2016. See IAEA, “Amendment to the Convention on the Physical Protection of Nuclear Material,” INFCIRC/274/Rev.1/Mod.1, May 9, 2016, <https://www.iaea.org/sites/default/files/infcirc274r1m1.pdf>.

56 IAEA, Nuclear Security Culture: Implementing Guide, IAEA Nuclear Security Series No. 7 (Vienna: International Atomic Energy Agency, 2008).

57 IAEA, Nuclear Security Culture, p. 5.

58 Igor Khripunov, “A culture of security: Focus for the next Nuclear Security Summit?,” Bulletin of the Atomic Scientists, June 26, 2015, <https://thebulletin.org/2015/06/a-culture-of-security-focus-for-the-next-nuclear-security-summit/>.

59 Khripunov, “A culture of security.”

60 IAEA, Self-assessment of Nuclear Security Culture in Facilities and ActivitiesNuclear Security Series No. 28-T (Vienna: International Atomic Energy Agency, 2017).

61 Khripunov, “A culture of security.”

62 WINS, “Nuclear Security Culture—A World Institute for Nuclear Security Best Practice Guide,” February 2019 (available to WINS members); (UK) Nuclear Industry Safety Directors' Forum, “Key Attributes of an Excellent Nuclear Security Culture, June 2013, <https://www.nuclearinst.com/write/MediaUploads/SDF%20documents/Security/Key_attributes_of_an_excellent_Nuclear_Security_Culture.pdf>.

63 IAEA, Self-assessment of Nuclear Security Culture, p. 36.

64 William G. Tierney, “Organizational Culture and Leadership,” Academy of Management Review, Vol. 11, No. 3 (1986), p. 17, <https://www.jstor.org/stable/pdf/258322.pdf>.

65 Edgar H. Schein, Organizational Culture and Leadership, 3rd edn., (San Francisco: Jossey-Bass, 2004), p. 16.

66 Edgar H. Schein, “National and Occupational Culture Factors in Safety Culture,” revised draft for IAEA meeting, April 9, 2014, p. 3, <https://gnssn.iaea.org/NSNI/SC/WS_GSC/National%20and%20Occupational%20Culture%20Factors%20in%20Safety%20Culture_Prof%20Edgar%20H%20Schein.pdf>.

67 Schein, Organizational Culture and Leadership, p. 24.

68 IAEA, Nuclear Security Culture: Implementing Guide, p. 19.

69 Tierney, “Organizational Culture and Leadership,” p. 677.

70 IAEA, Self-assessment of Nuclear Security Culture, pp. 41–60.

71 IAEA, Nuclear Security Culture: Implementing Guide, p. 19.

72 The authors conducted 43 interviews with a wide range of staff within nuclear organizations managed by the NDA, including nuclear power plants, facilities with Category I nuclear material (the types of nuclear material requiring the highest level of physical protection), and low-level-waste repositories. The interviews were carried out as part of a broader exercise to assess security culture within the NDA.

73 Examples in the area of computer security include H. Liang and Y. Xue, "Understanding Security Behaviors in Personal Computer Usage: A Threat Avoidance Perspective," Journal of the Association for Information Systems, Vol. 11, No. 7 (July 2010), pp. 394–413, <https://www.researchgate.net/profile/Huigang-Liang/publication/220580586_Understanding_Security_Behaviors_in_Personal_Computer_Usage_A_Threat_Avoidance_Perspective/links/55b6fef008aec0e5f4380213/Understanding-Security-Behaviors-in-Personal-Computer-Usage-A-Threat-Avoidance-Perspective.pdf>.; and L. Zhang and W. McDowell, "Am I Really at Risk? Determinants of Online Users' Intentions to Use Strong Passwords," Journal of Internet Commerce, Vol. 8, No. 3 (July 2009), pp. 180–197, doi: 10.1080/15332860903467508.

74 IAEA, Nuclear Security Culture: Implementing Guide, p. 19.

75 IAEA, Development, Use and Maintenance of the Design Basis Threat: Implementing Guide, IAEA Nuclear Security Series No. 10 (Vienna: International Atomic Energy Agency, 2009).

76 Matthew Bunn and Kathryn M. Glynn, “Preventing Insider Theft: Lessons from the Casino and Pharmaceutical Industries,” Journal of Nuclear Materials Management, Vol. 41, No. 3 (Spring 2013), pp. 4–16, <https://dash.harvard.edu/bitstream/handle/1/10861136/Preventing%20Insider%20Theft-V%2041_3.pdf>.

77 Björn Lindström and Armita Golkar, with Simon Jangard, Philippe N. Tobler, and Andreas Olsson, “Social threat learning transfers to decision making in humans,” Proceedings of the National Academy of Sciences of the United States of America, Vol. 116, No. 10 (March 5, 2019), pp. 4732–4737, <https://www.pnas.org/content/pnas/116/10/4732.full.pdf>; Joshua Wood, “Framing terror: an experimental framing effects study of the perceived threat of terrorism,” Critical Studies on Terrorism, Vol. 4, No. 2 (August 2011), pp. 119–217, <https://www.tandfonline.com/doi/abs/10.1080/17539153.2011.586205>.

78 Company director, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with the authors, Cumbria, November 1, 2017.

79 See, for example, a US NRC study that found that the majority of insider thefts occurred more than five years after the start of employment. Mullen, “Generic Adversary Characteristics,” p. 103.

80 Matthew Bunn and Eben Harrell, “Threat Perceptions and Drivers of Change in Nuclear Security Around the World: Results of a Survey,” Belfer Center for Science and International Affairs, March 2014, pp. 4–6, <https://www.belfercenter.org/publication/threat-perceptions-and-drivers-change-nuclear-security-around-world-results-survey>.

81 Mullen, “Generic Adversary Characteristics,” p. 102.

82 Bunn and Glynn, “Preventing Insider Theft,” p. 16.

83 WINS, “ICONS: Nuclear Security Takes Centre Stage on February 12,” World Institute for Nuclear Security, December 12, 2019, <https://wins.org/nuclear-security-takes-centre-stage/>; Jongsook Kim and Hyung-kyung Lee, with Jin-young Lee, “Challenges and Responses for Ensuring Sustainability of INSA Training Programs,” International Journal of Nuclear Security, Vol. 2, No. 1 (2016), p. 4, <https://trace.tennessee.edu/cgi/viewcontent.cgi?article=1039&context=ijns>.

84 Maurizio Cavallari, “A Conceptual Analysis about the Organizational Impact of Compliance on Information Security Policy,” Exploring Services Science Third International Conference, IESS 2012, Geneva, Switzerland, February 15–17, 2012, pp. 101–102, doi: 10.1007/978-3-642-28227-0_8.

85 Iacovos Kirlappos and Simon Parkin, with M. Angela Sasse, “Learning from ‘Shadow Security’: Why understanding non-compliant behaviors provides the basis for effective security,” paper presented at the Workshop on Usable Security, San Diego, CA, USA, February 23, 2014, <https://discovery.ucl.ac.uk/id/eprint/1424472/1/Kirlappos%20et%20al.%20-%202014%20-%20Learning%20from%20%E2%80%9CShadow%20Security%E2%80%9D%20Why%20understanding.pdf>. (For the full workshop program, see <https://www.ndss-symposium.org/ndss2014/workshop-usable-security-usec-2014-programme/>.)

86 Business officer, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with the authors, Cumbria, January 16, 2018.

87 Finance officer, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with the authors, Cumbria, November 1, 2017.

88 Personnel manager, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with the authors, Cumbria, September 19, 2017.

89 This was not the case in all organizations, with other interviewees noting that members of the security team were increasingly approachable and willing to have detailed discussions about security procedures.

90 Wyn Q. Bowen and Christopher Hobbs, “Sensitive Nuclear Information: Challenges and Options for Control,” Strategic Analysis, Vol. 38, No. 2 (March 2014), p. 225, <https://www.tandfonline.com/doi/abs/10.1080/09700161.2014.884441>.

91 Bowen and Hobbs, “Sensitive Nuclear Information,” p. 225.

92 IAEA, Nuclear Security Culture: Implementing Guide, pp. 32–33.

93 Security manager, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with the authors, Cumbria, December 9, 2019.

94 US Government Accountability Office, “Department of Energy: Whistleblower Protections Need Strengthening,” US Government Accountability Office, GAO-16-618, July 11, 2016, pp. 1–66, <https://www.gao.gov/products/gao-16-618>.

96 Mullen, “Generic Adversary Characteristics,” p. 103; R. N. Reinstedt and Judith Westbury, “Major Crimes as Analogs to Potential Threats to Nuclear Facilities and Programs,” Rand, N-1498-SL, April 1980, <https://www.rand.org/content/dam/rand/pubs/notes/2009/N1498.pdf>.

97 DoE, Office of Inspector General, “Special Report,” p. 7.

98 IAEA, Self-assessment of Nuclear Security Culture, pp. 2, 11.

99 IAEA, Self-assessment of Nuclear Security Culture, pp. 9, 11.

100 Vladimir Yankov and Seema Gahlaut, “Stakeholder: Hands on Experience in Culture and Future Strategies,” in Julia Thompson and Seema Gahlaut, eds., CBRN Security Culture in Practice, NATO Science for Peace and Security Series (IOS Press, 2015), pp. 59–61; Carsten Speicher and Igor Khripinov, with Nataliia Klos, and Jan Soderman, “Assessment of Security Culture at Nuclear Power Plants,” in Thompson and Gahlaut, CBRN Security Culture in Practice), pp. 139–141.

101 I. Khripunov, and P. Khairul, with D. Ebel and D. Nikonov, “Assessing Nuclear Security Culture: The Experience of Indonesia,” paper presented at the International Nuclear Materials Management annual meeting, Atlanta, United States, July 20–24, 2013.

102 Centre for the Protection of National Infrastructure, “Introduction to SeCuRE 4,” Centre for the Protection of National Infrastructure, 2018, p. 1, <https://www.cpni.gov.uk/system/files/documents/5b/c9/Introduction_to_SeCuRE_4.pdf>.

103 Security officer, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with authors, Cumbria, January 16, 2018.

104 Security officer, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with authors, Cumbria, August 8, 2017.

105 Khairul Khairul, “Nuclear Security Culture Self Assessments at Nuclear Research Reactors: BATAN’s Experiences,” paper presented at the Insider Threat Mitigation Symposium, Brussels, Belgium, March 12–14, 2019, <http://insiderthreatmitigation.org/assets/docs/presentations/12Mar-KKhairul-StratChall4.pdf>; Anhar Riza Antariksawan and Khairul Khairul, with Heru Umbara, Endang Kristuti, and Bayu Purnomo, "Conducting Nuclear Security Culture Self-Assessments in Nuclear Research Facilities Using the IAEA Methodology," International Journal of Nuclear Security, Vol. 4, No. 1 (June 2018), p. 12, <https://trace.tennessee.edu/cgi/viewcontent.cgi?article=1080&context=ijns>.

106 Khripunov et al., “Assessing Nuclear Security Culture,” p. 3.

107 Khripunov et al., “Assessing Nuclear Security Culture,” p. 3.

108 Antariksawan et al., "Conducting Nuclear Security Culture Self-Assessments," p. 3.

109 Paul E. Ebel and K. Khairul, with Igor Khripunov, Noor Syakeera Mukhelas, and Pirunthavany Muthuvela, “Self-Assessment of Security Culture for Users of Radioactive Sources,” presented at the Institute of Nuclear Materials Management Annual Meeting, Indian Wells, California, USA, July 12–16, 2015.

110 Security officer, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with authors, Cumbria, January 16, 2018.

111 Contractor, nuclear operator (name and organization withheld by request), UK NDA, in-person interview with authors, Cumbria, January 16, 2018.