Overview of NRC

Joe RiversOffice of Nuclear Security and Incident Response

May 17, 2018

Outline

• NRC Regulatory Approach• Key Focus Areas• International Engagement

2

NRC Regulatory Approach

3

4

NRC Mission Statement

License and regulate the Nation's civilian use of byproduct, source, and special nuclear materials (SNM) to ensure adequate protection of public health and safety, to promote the common defense and security, and to protect the environment

5

Scope of Responsibility

Three main areas: Reactors: commercial reactors for generating electric

power and non-power reactors used for research, testing, and training

Materials: uses of radioactive materials in medical, industrial, and academic settings; and nuclear materials and facilities associated with the nuclear fuel cycle

Waste: transportation, storage, and disposal of nuclear materials and waste, and decommissioning of facilities

6

Historical Background

Atomic Energy Act of 1954 (as amended)

Initial statutory basis for civilian use of SNM Established minimum safety and security requirements License granted by Atomic Energy Commission (AEC)

Energy Reorganization Act of 1974

AEC abolished and NRC created - civilian uses of nuclear materials and facilities

DOE responsible for weapons program - promotion of nuclear power, and other energy-related work

7

Purpose of NRC-regulatedPhysical Protection

10 CFR 73 – Requirements for the establishment and maintenance of a physical protection system which will have capabilities for the protection of SNM at fixed sites and in transit and of plants in which SNM is used

Physical protection systems are designed to protect against acts of radiological sabotage and to prevent the theft of special nuclear material.

8

NRC Regulation ofCommercial Nuclear Facilities

Regulations (10 CFR 1 thru 199)

Orders

Security Plans / Licensee Implementation

Inspection / Evaluation of Performance / Enforcement

9

Power Reactor & CAT ISecurity Comprehensive Security Programs, including:

Physical Security• Barriers Detection & Assessment Systems• Access Control Alarm Stations• Well-Trained Guard Force Response Strategies

Personnel Security• Background Checks Access Authorization• Fitness for Duty

Information Security & Cybersecurity

Robust Structures with Redundant Safety

Key Focus Areas

• Drones/Unmanned Aerial Vehicles (UAVs)• Cyber Security• Insiders• Modeling and Simulation

10

Unmanned Aerial Systems(a.k.a., Drones)

Should We BeConcerned?

• They are used in the Middle East to deliver a variety of payloads and to provide surveillance

• There were simultaneous overflights of French nuclear facilities

• There have been numerous overflights of DoD nuclear facilities

12

Regulatory Issues

• Drones regulated by Federal Aviation Administration (FAA) with a very strong lobby

• Federal Communications Commission (FCC) regulated wireless communication

• DoD and DOE have some legal authority

13

Technical Issues

• Rapidly evolving technology• Difficult to detect• Multiple technologies used for guidance• Countering is a challenge

14

Coordination

• Other Government Agencies• Other Governments• Industry

15

Detection Technologies

• Radar• Visual• Radio Frequency Scanning

16

Countering Technologies

• Jamming• Taking over controls• Kinetic• Nets• Hawks/Eagles

17

Next Steps

• Vulnerability study by Sandia for NPPs and Fuel Cycle Facilities

• Recommendation to the Commission

18

NRC Cyber Security Regulatory Overview

05/01/201819

20

US NRC Cyber Security Program

NRC Issues various Orders & Guidance Documents for

NPPs to address the Physical & Cyber Threat

Industry’s Voluntary Implementation of an Interim Cyber Security Program

NRC Conducts Assessment Visits

Development of the Cyber Rule 10 CFR73.54 for NPPs

DBT UpdatePublic Law 109-58

Energy Policy Act 2005

Updated DBT 10 CFR 73.1

05/01/2018

21

US NRC Cyber Security ProgramRG 5.71 & NEI 08-09

Implementation Guidance Acceptable

for Use

NRC & Industry collaborative work on

implementation guidance:

• Security Frequently Asked Questions

(SFAQs)

• NEI 13-10 Assessment of Security Controls

• NRC Participates in Industry Workshops

20102009 2011 2013 2014 2015 2016Cyber Security Implementation

Inspections2017

Industry’s Interim Implementation Schedule

MS 1 – 7 Inspections

All NPPs Cyber Security Plans & Implementation

Schedules Approved

Pilot Inspections Conducted at 2 NPPs

NRC & Industry agree on MS 1 – 7 Implementation

Schedule

2012

21

NRC Cyber Security

Notification Rule10 CFR 73.77

05/01/2018

• Tabletops to assess inspection

procedure

• Development of Additional Guidance

for Implementation Schedules

• Meetings with the Industry

22

1. Cyber Security Assessment Team

2. Identify Critical Digital Assets (CDAs)

3. Implement Defensive Architecture

4. Apply Security Controls

RG 5.71, “Cyber Security Program for Nuclear Facilities”

05/01/2018

7 Interim Milestones (Complete 2012)

23

MS 1 MS 2 MS 3 MS 4 MS 5 MS 6 MS 7

Establish the Cyber

Security Assessment

Team

Identify Critical Digital Assets

Implement One-way

Deterministic Device

Access Control for Portable &

Mobile Devices

Implement Observation & Identification of Obvious

Cyber Tampering

Apply Security

Controls to Most

Important Critical Digital

Assets

Implement Ongoing &

Assessment Activities for

Controls Applied

Full Implementation Inspection Program 2017 - 2020

Inspection Program2013 2015

05/01/2018

Full Implementation (MS8)

• Expands scope to include all Critical Digital Assets (CDAs)• All Safety & Security – Full

Cyber Controls• Graded Approach for Important-

to-Safety, Emergency Preparedness (EP) & Balance-of-Plant (BoP)

• Attack Mitigation and Incident Response Testing and Drills

• Continuity of Operations Training, Testing

• Secure Communication Pathways to CDAs• Ensure only authorized,

protected communication from known devices is permitted

• Supply Chain• Adds security requirements

relevant to vendors, contractors, and developers

• Ensure Availability and Integrity of Information To, From, and On CDAs• Prevent CDAs from accessing,

receiving, transmitting, or producing unverified or untrusted information

• Configuration Management• Ongoing Evaluation and

Management of Cyber Risk• Audit and Accountability

05/01/201824

Insider Mitigation Program for Nuclear Facilities

Concept of the Insider Threat Is Not New

• Quis custodiet ipsos custodes? is a Latin phrase attributed to the Roman poet Juvenal from his Satires(Satire VI, lines 347–8), which is literally translated as "Who will guard the guards themselves?“

• While the concept of the insider threat is not new, an insider mitigation program must be adaptable to meet the challenges of an ever changing global threat environment.

1

Legislative & Regulatory Authority Important to Success of Programs

• Insider mitigation programs are more effective with standards that have a basis in law and are codified within a regulatory framework.– Establishes minimum requirements which can be inspected by an

independent regulatory body to ensure processes and procedures within programs are functioning as intended.

– Provides oversight and clarity for the facility owners and/or operators

– Public confidence is enhanced with an independent regulator– Regulatory frameworks benefit from processes that provide a

means to accommodate changes as necessary.• Rulemaking• Orders & Generic Communications• Guidance documents

2

Technology Component of Insider Mitigation Strategy

• Advances in technology adapt to the changing threat environment– Biometric identity verification tools

• Hand geometry for access to protected areas• Retina scans for access to protected areas• Finger print scanning devices

– Access to criminal history and other robust databases – State-of-the-art video surveillance– Explosive and metal detection devices– Detection devices for drug and alcohol use

3

Behavior ObservationProgram (BOP) Component

• Training on warning signs of aberrant or other behavior not conducive to trustworthiness and reliability• What to do if you observe aberrant behavior – see something,

say something• Processes in place to address aberrant behavior for the

protection of the workers and the facility• Hot line• Employees assistance program• Regular supervisory reviews

• Fair and balanced application of a BOP• Consent forms• Appeal process

4

Objective of the NRC Insider Mitigation Program (IMP)

• Licensee oversight and monitoring of the initial and continuing trustworthiness and reliability of individualsby -• Minimizing the potential for an insider to directly or indirectly

have an adverse impact on the licensee’s capability to prevent significant core damage or spent fuel sabotage.

• Applies to all individuals following licensee’s initial unescorted access (UA) and unescorted access authorization (UAA) determination and/or certification of UA & UAA.

• Applies to individuals who retain UA or UAA to the protected and vital areas.

5

Examples of What to Look ForIn the IMP

• Tampering with equipment and/or systems – Valves out of proper position– Fluid levels (DORL 4 Belgium incident)– Workers in areas where they have no business

• Aberrant behavior or unexplained absences from work• Disgruntled employee• Radicalization or extremist views

• Shariff Mobley incident in 2010

• Drug or alcohol abuse

• Affiliations with criminal elements

1 1

Warning Signs Questionable Affiliations

• Security force member (Critical Group) at nuclear plant active member of outlaw motorcycle gang– Never returned to work after being interviewed about his

affiliations by access authorization staff at the plant.

12

Disgruntle Employees With Unescorted Access

• November 1979 - Two employees working at Surry Nuclear power plant attempted to damage new fuel assemblies.

– One employee had served aboard ship in the U.S. Navy’s nuclear program

– Both employees had been granted unescorted access to a vital area in the plant

– Both employees were convicted of intentional damage to a facility which furnishes electric power to the public and sentenced to two years in prison

– The Nuclear Regulatory Commission issued information notice 79-12 to all nuclear power plants to share the information with the licensees that own and operate the plants.

13

$ Socio-Economic Impact $Tampering Incident

At Belgian Nuclear Plant• August 2014 - Belgian energy company Electrabel reported that its Doel 4

nuclear reactor would stay offline until the end of year after major damage to its steam turbine was caused by a leak of 65,000 liters of oil.

– Reuters news quoted a spokesman for GDG Suez which is the French parent company - “There was an intentional manipulation”.

– Prosecutors familiar with the incident would not confirm that it was sabotage and they would not exclude sabotage either.

$ 37 Million to repair turbine in Germany

$ Loss of ~ 1 gigagwatt of generating capacity to consumers during colder months & reduced company earnings for GDG Suez.

14

Offsite Behavior Matters • NRC regulations require self-reporting of any criminal charges or

arrests• Two Senior Reactor Operators (Critical Group) arrested for

aggravated car-jacking and fled to Venezuela.

• Two Non-licensed Operators arrested for aggravated assault on and obstructing a peace officer at offsite party.

15

Why use modeling and simulation?

• It helps us better understand how the security system elements work together

• It helps us understand the strengths and weaknesses of the security system

• It provides a cost-effective way to perform a systematic evaluation of security system effectiveness

37

What Simulations Don’t Do

• Simulations cannot predict the future– They can’t tell when or how an attack will occur

• Simulations are not the solution by themselves– Security personnel must still perform effectively– They do not eliminate the need for FoF– They do not eliminate the need for performance

testing

38

Evaluating Complex SecuritySystems

• Simulations are used to understand the interactions and relationships within a complex system– People can understand and analyze system components, but are

limited by scope, scale and personal biases– Computer simulations offer objectivity, and they can more easily

assess greater scope and scale of systems

39

How Simulations Are Used

• Pathway Analysis– Identify most vulnerable pathways for an adversary– Probability of detection (Pd)

• Neutralization– Determine outcome of attack scenario– Probability of neutralization (Pn)

• System Effectiveness– Pe = Pd x Pn

40

Other Uses for Simulation

• Training• Tabletop exercises• Insider analysis• Site visualization• Sensor coverage• What if analysis• Defense-in-depth analysis

41

Some of the Benefits

• Computing system effectiveness• Cost-benefit analysis• Planning for upgrades or new construction• Right-sizing defensive forces• Technology evaluations

42

International Engagement

• IPPAS Missions• Bilateral Engagements• IAEA Meetings

43

IPPAS Missions

• NRC hosted an IPPAS Mission in the Fall of 2013

• NRC supports IPPAS missions and follow-up missions on a regular basis

44

Bilateral Engagements

• NRC supports US Government bilateral interactions with governments around the world

• NRC conducts its own bilateral exchanges with governments around the world

45

IAEA Meetings

• NRC staff participate in a wide variety of IAEA meetings– Technical Meetings– Consultants Group Meetings– Coordinated Research Projects– Training Courses– Conferences

46

47

Questions?