Chapter 3　Nuclear Security1

(1) Physical Protection of Nuclear Materials and Facilities

A) Nuclear Materials

“Nuclear security” means “the prevention of, detection of, and response to, criminal or intentional unauthorized acts involving or directed at nuclear material, other radioactive material, associated facilities, or associated activities.”2

On the subject of physical protection, a major element of nuclear security measures, the latest version of the IAEA’s “Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities,” also known as INFCIRC/225/Rev.5, was published in 2011 as its Nuclear Security Series No. 13. It recommends that requirements for physical protection “should be based on a graded approach, taking into account the current evaluation of the threat, the relative attractiveness, the nature of the nuclear material and potential consequences associated with the unauthorized removal of nuclear material and with the sabotage against nuclear material or nuclear facilities.”3

As shown in Table 3-1, the type of nuclear material itself is the primary factor for determining the physical protection measures against unauthorized removal. The different types of nuclear material are categorized in terms of element, isotope, quantity, and irradiation. This categorization then forms the basis for a graded approach to protection against unauthorized removal of “attractive” nuclear material that could be used in a nuclear explosive device, which itself depends on the types of nuclear material, isotopic composition, physical and chemical form, degree of dilution, radiation level, and quantity.4

Weapons-grade fissile materials are generally thought to be attractive to terrorists who are looking to produce nuclear explosive devices. Therefore, these materials require high-level protection measures. In this regard, the amount of weapon-usable nuclear materials as well as the number of facilities that contain such materials in a country are considered to be one of the important indicators for assessing that state’s efforts in enhancing nuclear security.

Table 3-2, which is based on various open-source information, shows the estimated amount of weapons-usable fissile materials held by the countries surveyed for this report. While stocks of Highly Enriched Uranium (HEU) for civilian use is in decrease, those of separated plutonium for civilian use is increasing.

The following surveyed countries, not included in Table 3-2, are also assumed to possess highly enriched uranium (HEU) as of November 2021.

➢ More than 1 metric ton (category I is 5 kg and more): Kazakhstan (approximately 10,000kg, irradiated)5
➢ 1 kg or more: Australia (2.726 kg unirradiated, 0.02 kg irradiated)6, Canada (less than 838kg)7, Iran (17.7 kg)8, the Netherlands (approximately 600 kg), Norway (less than 1 kg unirradiated, 3kg irradiated)9, and South Africa (approximately 700 kg unirradiated)10
➢ Less than 1 kg: Syria

As a result of efforts made by the Global Threat Reduction Initiative (GTRI), the number of countries that have completely removed HEU has increased in recent years. The surveyed countries that have achieved complete removal of HEU are the following 12 countries: Austria, Brazil, Chile, Indonesia, South Korea, Mexico, Nigeria, the Philippines, Poland, Sweden, Switzerland and Turkey.11

 

B) Radioactive Material

Ensuring the security of radioactive material and radioactive sources, in particular, is another important issue. For example, the Ministerial Declaration the IAEA International Conference on Nuclear Security 2020 (ICONS 2020) expressed their commitment to “maintaining effective security of radioactive sources throughout their life cycle, consistent with the objective of ‘the Code of Conduct on the Safety and Security of Radioactive Sources’ and its supplementary guidance documents.”12

This Code of Conduct was published by the IAEA in January 2004, and 140 countries have made a political commitment to implement the Code, as of September 2021.13 All the surveyed countries, except North Korea, have already made such a commitment. The Code of Conduct is not a legally binding instrument, but rather involves convening a meeting every three years “to report on progress, exchange lessons learned, and discuss areas in need of improvement.” It provides a platform for those countries that have made a commitment to conduct a wide-ranging exchange of information concerning the national implementation of the Code.14

In 2021, the following relevant efforts were made to strengthen the security of radioactive materials at the international level. The IAEA “continued its project focused on enhancing national regulatory infrastructure for radiation safety and security of radioactive material in Africa, with a total of 38 participating States.”15 “As part of this project, two virtual regional workshops on policy and strategy for the safety and security of radioactive material were held, in March 2021 for English-speaking African States and in April 2021 for French-speaking African States.”16 In addition, at the IAEA, preparations are underway for the International Conference on the Safety and Security of Radioactive Sources, which is scheduled to take place in June 2022 in Vienna “to foster the exchange of experiences and anticipated future developments related to establishing and maintaining a high level of safety and security of radioactive sources throughout their life cycle.”17

As for efforts made by the surveyed countries in 2021, IAEA physical protection projects to secure radioactive material in fixed applications in Egypt and Pakistan were carried out.18 Also, an IAEA project for the removal of high activity disused sources to secure the management of disused sources was carried out in Chile.19 Moreover, in September, the United States has launched a radiological security project known as the “RadSecure 100 Initiative.” This initiative “will focus on removing radioactive material from facilities (where feasible) and improving security at the remaining facilities located in 100 metropolitan areas throughout the United States.”20

C) Nuclear Facilities

Nuclear facilities that could be a target of sabotage which may incur potential serious radiological consequences include 1) nuclear power plants, 2) research reactors, 3) uranium enrichment facilities, 4) reprocessing facilities, and spent fuel storage facilities. As of December 2021, there were 440 (-2) reactors operating worldwide, 56 (+4) under construction, 99 (-1) being planned, and 325 (-1) proposed to be built. (Numbers in parentheses above and below indicate the increase or decrease compared with the previous year.)21

With respect to research reactors,22 as of November 2021, there were a total of 842 (-4) worldwide. Below is the breakdown of the status of the 842 research reactors:

➢ Operational: 220 (-2)23
➢ Temporary Shutdown: 15 (+1)
➢ Under Construction: 11 (±0)
➢ Planned: 14 (-3)
➢ Extended Shutdown: 13 (±0)
➢ Permanent Shutdown: 58 (±0)
➢ Decommissioned: 446 (±0)
➢ Under Decommissioning: 65 (±0)

(Numbers in parentheses above and below indicate the increase or decrease compared with the previous year)24.

Regarding HEU spent fuel assemblies at research reactors, there are 20,596 enriched to levels above 20%. Nine thousand four hundred and sixty-five out of 20,596 are enriched to levels at or above 90%. This number is 67 less compared to the previous year.25 In terms of geographical distribution, 10,627 HEU spent fuel assemblies are currently stored in Eastern Europe, 4,206 in Western Europe, 3,492 in Asia, 1,614 in North America, 572 in Africa and the Middle East, and 85 in Latin America.26 The aforementioned reduced 67 were previously stored in Western Europe. This state of affairs shows that strengthening preventive measures for sabotage against research reactor facilities remains of vital importance. HEUs for military use accounts for approximately 90% of the HEUs in the world and it is important to ensure nuclear security of HEUs not only for civilian use but also for military use.

Uranium enrichment and reprocessing facilities are regarded as particularly “attractive” for malicious actors, such as terrorists who may seek to make nuclear explosive devices. Table 3-3 shows the presence of uranium enrichment and reprocessing facilities as well as nuclear power plants and research reactors in the countries surveyed.
In relation to sabotage against nuclear facilities, several relevant incidents involving Unmanned Aerial Vehicles (drones) have been occurring in recent years.27 While drones have been utilized more frequently for purposes such as inspections, the potential threat they pose to nuclear security threat has also increased. In June 2021, for example, while Iran’s Atomic Energy Agency said that an attack on one of its facilities had been foiled, with no structural damage to the site, it was reported that a nuclear facility near the city of Karaj was attacked by a small drone.28 Further, Israeli media reported that “the attacked site was likely one of Iran’s centrifuge manufacturing sites” for producing enriched uranium and the facility was damaged.29 In addition, in the United States, several small drones flew around a restricted area at Palo Verde Nuclear Power Station, known as the largest nuclear power station in the country, and were circling the site for more than an hour and a half on two successive nights in September 2019. No physical damage was incurred. While some suspect the flight was for a reconnaissance purpose, it remains unknown who carried it out and why.30

Furthermore, in the United States, it was reported in November 2021 that two drones approached a power substation in Pennsylvania in July 2020. It was highly likely that they attempted to disrupt the operation of the substation.31 It was said that “this incident constitutes the first known instance of a modified and uncrewed aircraft system being used to ‘specifically target’ energy infrastructure of the United States.”32 This case shows again that drone threat against critical infrastructure, possibly including nuclear facilities, is real.

 

Concerning the discussion on the threat of drones, the U.S. Nuclear Regulatory Commission (NRC) concluded in an unclassified technical analysis report published in October 2019 that nuclear power plants “do not have any risk-significant vulnerabilities that could be exploited” by attacks using commercially available drones that would result in “radiological sabotage” or theft of “special nuclear material (essentially, reactor fuel).”33 The report also concluded that “any information an adversary could glean from overhead surveillance using drones is already accounted for in the NRC’s design-basis threat (DBT), which assumes adversaries have insider information about the plant and its operations.”34 In the meantime, the report also said the NRC would continue evaluating the impact of drone technologies.35

There are also concerns about the potential for “adversarial attacks” involving small unmanned aircraft and the need for defenses against them. A case in point was a largely undisclosed incident involving a swarm of drones on successive September evenings in 2019 at America’s most powerful nuclear plant, the Palo Verde Nuclear Generation Station located west of Phoenix, Arizona. According to a newspaper report about the incident, lower-end and lower-performance drones have become weaponized to an increasingly remarkable degree in recent years.36 Other reports pointed out that drones “would use their ability to strike pinpoint targets to hit control systems and fail safes.”37 In light of such circumstances, there is a clear need to strengthen security measures against drone threats assuming various scenarios.

In addition to the drone threat, concerns over cyber-attacks against nuclear facilities have risen. It was reported that there were 23 cases of cyber-attack cases in the quarter of a century since 1990,38 and the number has been increasing. Also, the frequency of such attacks has increased since 2010.39 In April 2021, an explosion caused a power outage at a nuclear facility in Natanz, Iran. The Iranian Atomic Energy Agency said the case was a “destructive operation” and a “nuclear terrorism,” while Israeli media reported that it was a cyber-attack by Israel.40 In addition, in May 2021, there was a cyber-attack on the South Korean Atomic Energy Research Institute (KAERI). The attack took advantage of a vulnerability in the Virtual Private Network (VPN) system and multiple unauthorized IP address accessed the KAERI internal network.41 Furthermore, in May 2021, Japan’s Nuclear Regulation Authority (NRA) announced that cyberattacks had been carried out on the NRA’s internal network since 2019, and intrusions were repeated until October 2020 when they were detected. More than 250 IDs and passwords were stolen in the process.42 Also, although this is not a case at nuclear facility, in May 2021, there was a cyber-attack using ransomware against one of the largest oil pipelines in the United States.43

So far, there have been no cyber-attacks resulting in radiation effects, but as shown above, the cyber threat against nuclear facilities is real. The threat is complex and diversified, and thus strengthening measures for information security and computer security has become an even more important issue than ever before.44

---

1 This chapter is authored by Junko Horibe. In writing this chapter, the corresponding chapter of the Hiroshima Report 2020 written by Sukeyuki Ichimasa was referenced.
2 IAEA, “Nuclear Security Series Glossary Version 1.3 (November 2015) Updated,” p. 18.
3 IAEA, “Nuclear Security Series No.13 Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Rev.5),” 2011, paragraph 3.37.
4 INFCIRC/225/Rev.5, paragraph 4.5.
5 “Countries: Non-nuclear Weapon States,” International Panel on Fissile Material, August 31, 2021, https://fissilematerials.org/countries/others.html; “Materials: Highly Enriched Uranium,” International Panel on Fissile Material, May 22, 2020, http://fissilematerials.org/materials/heu.html; National Nuclear Security Administration, “Kazakhstan and U.S. Cooperate to Eliminate Highly Enriched Uranium in Kazakhstan,” September 22, 2020, https://www.energy.gov/nnsa/articles/kazakhstan-and-us-cooperate-eliminate-highly-enriched-uranium-kazakhstan.
6 INFCIRC/912/Add.4, March 5, 2020.
7 “Civilian HEU: Who Has What?” Nuclear Threat Initiative, October 2019, https://media.nti.org/ documents/ heu_who_has_what.pdf; “Canada, USA Complete Used Fuel Return,” World Nuclear News, February 13, 2020, https://world-nuclear-news.org/Articles/Canada,-USA-complete-used-fuel-return; “CNL Completes Repatriation of HEU Target Residue Material to United States,” Canadian Nuclear Laboratories, January 26, 2021, https://www.cnl.ca/cnl-completes-repatriation-of-heu-target-residue-material-to-united-states/; Canadian Nuclear Safety Commission, “Highly Enriched Uranium in Canada,” February 19, 2021, https://nuclearsafety.gc.ca/eng/reactors/research-reactors/nuclear-facilities/chalk-river/highly-enriched-uranium-in-canada.cfm.
8 IAEA, “Verification and Monitoring in the Islamic Republic of Iran in light of United Nations Security Council Resolution 2231 (2015): Report by the Director General,” GOV/2021/51, November 17, 2021.
9 INFCIRC/912/Add.3, August 19, 2019, p. 3.
10 “Civilian HEU: South Africa,” Nuclear Threat Initiative, July 1, 2019, https://www.nti.org/analysis/ articles/civilian-heu-south-africa/.
11 “Materials: Highly Enriched Uranium.”
12 “Ministerial Declaration,” ICONS 2020, February 2020, p. 2.
13 IAEA, “List of States Expressing a Political Commitment,” September 15, 2021, https://nucleus-new.iaea.org/sites/ns/code-of-conduct-radioactive-sources/Documents/Status_list%2015%20Septem ber%20%202021.pdf.
14 IAEA, “A Process for the Sharing of Information as to States’ Implementation of the Code of Conduct on Safety and Security of Radioactive Sources and Its Associated Guidance on the Import and Export of Radioactive Sources,” https://www-ns.iaea.org/downloads/rw/code-conduct/code-formalized-process-english.pdf. At the last meeting, which took place in 2019, the IAEA noted the following three areas where improvement is remained necessary: an independent regulatory body, control of radioactive sources, and radioactive sources out of regulatory control. IAEA, “Wider Implementation of IAEA Code of Conduct to Enhance Safety and Security: Review Meeting Concludes,” June 11, 2019, https://www.iaea.org/ newscenter/news/wider-implementation-of-iaea-code-of-conduct-to-enhance-safety-and-security-review-meeting-concludes.
15 IAEA, Nuclear Security Report 2021, GOV/2021/35-GC(65)/10, July 20, 2021, p. 17.
16 Ibid.
17 “International Conference on the Safety and Security of Radioactive Sources- Accomplishments and Future Endeavours, 20-24 June 2022, Vienna, Austria,” IAEA, https://www.iaea.org/events/safety-security-radioactive-sources-2022.
18 IAEA, Nuclear Security Report 2021, p. 17.
19 Ibid.
20 “NNSA Launches Radiological Security Initiative in 100 U.S. Cities,” NuclearNewswire, September 3, 2021, https://www.ans.org/news/article-3217/nnsa-launches-radiological-security-initiative-in-100-us-cit ies/; Mary Ann Hurtado, “U.S. Advances Nuclear Security Goals,” Arms Control Today, October 2021.
21 “World Nuclear Power Reactors & Uranium Requirements,” World Nuclear Association, December 2021, https://world-nuclear.org/information-library/facts-and-figures/world-nuclear-power-reactors-and-uranium-requireme.aspx.
22 On the security of research reactors, the Co-Presidents’ Report of ICONS 2020 notes that when discussing approaches for risk assessment at research reactors, “explicit consideration of cyber and insider risks could be useful.” “Co-Presidents’ Report,” p. 11.
23 Out of 220 reactors, 171 of these were constructed with an HEU core. Seventy-one HEU fuel reactors have been converted to LEU since 1978. Twenty-eight that were HEU-fueled have been shut down, another 72 are still powered by HEU, mostly for scientific reasons. Laura Gil, “Countries Move Towards Low Enriched Uranium to Fuel Their Research Reactors,” IAEA Bulletin, November 2019, Vol. 60-4, pp. 26-27.
24 IAEA, “Research Reactor Data Base,” https://nucleus.iaea.org/RRDB/RR/ReactorSearch.aspx?rf=1.
25 IAEA, “Worldwide HEU and LEU Assemblies by Enrichment,” https://nucleus.iaea.org/RRDB/ Reports/Container. aspx?Id=C2.
26 IAEA, “Regionwise distribution of HEU and LEU,” https://nucleus.iaea.org/RRDB/Reports/ Container.aspx?Id=C1.
27 Incidents related to the drone threat since 2014, see Jae San Kim, “A Study on the Possibility of Unmanned Aerial Vehicles (UAV)’ Threat in Nuclear Facilities,” Transactions of the Korean Nuclear Society Annual Meeting, Goyang, Korea, October 22-25, 2019.
28 Farnaz Fassihi and Ronen Bergman, “Iran Atomic Agency Says It Thwarted Attack on a Facility,” New York Times, June 23, 2021.
29 Yonah Jeremy Bob and Tzvi Joffre, “Iran Nuclear Centrifuge Facility Substantially Damaged in Attack-Sources,” Jerusalem Post, June 24, 2021.
30 David Hambling, “‘Drone Swarm’ Invaded Palo Verde Nuclear Power Plant Last September-Twice,” Forbes, July 30, 2020; Tyler Rogoway and Joseph Trevithick, “The Night A Mysterious Drone Swarm Descended on Palo Verde Nuclear Power Plant,” The Warzone, July 29, 2020.
31 “Intelligence Bulletin Reveals Potential Plot to Disrupt US Electrical Grid,” ABC News, https:// abcnews.go.com/WNT/video/intelligence-bulletin-reveals-potential-plot-disrupt-us-electrical-80961140; Joseph Trevithick, “Likely Drone Attack On U.S. Power Grid Revealed In New Intelligence Report (Updated),” The Warzone, November 4, 2021. In 2019, an oil facility in Saudi Arabia was attacked by a military drone. “Saudi Arabia Oil Facilities Ablaze after Drone Strikes,” BBC, September 14, 2019.
32 “A Drone Tried to Disrupt the Power Grid. It Won’t Be the Last,” WIRED, November 5, 2021.
33 Kelsey Davenport, “NRC Will Not Require Drone Defenses,” Arms Control Today, December 2019, https://www. armscontrol.org/act/2019-12/news-briefs/nrc-not-require-drone-defenses; “Drones and Nuclear Power Plant Security,” The United States Nuclear Regulatory Commission, November 4, 2020, https://www.nrc.gov/ reading-rm/doc-collections/fact-sheets/fs-drone-pwr-plant-security.html. “NRC decided not to require drone defenses at nuclear plants, asserting that small drones could not damage a reactor or steal nuclear material.” Hambling, “‘Drone Swarm’ Invaded Palo Verde Nuclear Power Plant Last September-Twice.”
34 “Drones and Nuclear Power Plant Security.”
35 Ibid.
36 Rogoway and Trevithick, “The Night A Mysterious Drone Swarm Descended On Palo Verde Nuclear Power Plant.”
37 Hambling, “‘Drone Swarm’ Invaded Palo Verde Nuclear Power Plant Last September-Twice.”
38 Ibid., pp. 10-15.
39 See Alexandra Van Dine, Michael Assante and Page Stoutland, “Outpacing Cyber Threats: Priorities for Cybersecurity at Nuclear Facilities,” Nuclear Threat Initiative, 2016, pp. 9-15.
40 Yonah Jeremy Bob, Lahav Harkov and Tzvi Joffre, “Mossad Behind Attack on Iran’s Natanz Nuclear Facility,” Jerusalem Post, April 13, 2021.
41 Rebecca Klapper, “North Korea Likely Culprit in Cyberattack on South Korea’s Atomic Energy Institute,” Newsweek, June 21, 2021, https://www.newsweek.com/north-korea-likely-culprit-cyberattack-south-koreas-atomic-energy-institute-1602625.
42 “Cyberattacks on NRA, 250 passwords stolen,” Asahi Shimbun Digital, May 20, 2021, https://digital.asahi. com/articles/ASP5N5JR0P5NULBJ012.html. (in Japanese)
43 Veronica Stracqualursi, Geneva Sands and Arlette Saenz, “Cyberattack Forces Major US Fuel Pipeline to Shut Down,” CNN, May 8, 2021.
44 The Ministerial Declaration of ICONS 2020 recognizes “the threats to computer security and from cyber-attacks at nuclear related facilities, as well as their associated activities including the use, storage and transport of nuclear and radioactive materials,” and calls on IAEA Member States to “strengthen protection of sensitive information and computer-based systems, and encourage the IAEA to continue to foster international cooperation and to assist Member States, upon request, in this regard.” “Ministerial Declaration,” p. 1.