Strengthening Nuclear Security in R&D Facilities: Insider Threat Countermeasures

Strengthening Nuclear Security in R&D Facilities Integrating National and Local Accounting Systems to Counter Insider Threats Carin YOTA KETCHIEKMEN The French alternative Energies and Atomic Energy Commission (CEA) Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 01/07/2024

Introduction Context and Importance of Nuclear Energy Nuclear energy is a key contender for sustainable and powerful energy sources in the 21st century. Its almost carbon-neutral profile is attractive for reducing carbon emissions and combating climate change. Advances in nuclear research have led to cutting-edge facilities and infrastructure. Challenges of Insider Threats Threat to nuclear facilities and nuclear material may comes from within. Insider threats involve individuals with legitimate access who may misuse this for malicious purposes. Threats can stem from disgruntled employees, financially motivated staff, or those coerced by external actors. Prevention Strategies A comprehensive approach is needed to address insider threats, combining technological, procedural, and cultural measures. Understanding the context and motivations behind these threats is essential for effective detection and deterrence. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 2

Objectives and Scope Evaluate the effectiveness of the NMAC system in France, particularly at the CEA. Examine the complementary role of national and local accounting to detect and deter insider threats. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 3

Background of the Research Advancements in nuclear research have led to cutting-edge facilities and infrastructure. The existence of possible threat highlight the necessity for robust security measures. Global warming and the need for sustainable energy solutions have driven diversification in nuclear research and development. Advanced nuclear reactors, including small modular reactors (SMRs) and Generation IV reactors, offer significant benefits and new opportunities. Insider threats involve individuals with knowledge, legitimate access and authority to nuclear materials. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 4

Methods Methods The study involved a detailed analysis of operational procedures, data management practices, and integration techniques used in the French nuclear material management and control (NMAC) system. Analyze operational procedures, data management practices, and integration techniques in the French nuclear material management and control system. Use case studies and hypothetical scenarios to evaluate the system's robustness. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 5

Unmasking Unmasking the the Insider Insider Threat Threat Perceived Security: Nuclear facilities appear as fortresses with robust external security, but insider threats have to be considered. Nature of Threats: Insider threats involve trusted individuals misusing legitimate access to divert nuclear materials, posing a security risks. Motivations: Motivations may include financial gain, ideological beliefs, coercion, or dissatisfaction with the employer. Detection and Prevention: Procedural measures: Recruitment, access authorization, weak signal reporting chain, alert chain, clear security policies, regular audits, background checks Technological solutions: Physical protection, access control, surveillance, monitoring systems. Cultural measures: Fostering security awareness and responsibility among personnel. Organizational Shift: Educate staff to recognize and report weak signals without creating mistrust. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 6

The Integral Role of NMAC The Integral Role of NMAC NMAC ensures accurate tracking and prevents diversion of nuclear materials through rigorous documentation, audits, and monitoring. Combines national accounting for a consolidated view and local accounting for detailed oversight. The French NMAC system operates on national and local levels. An important aspect of the NMAC system is the division of the facility in single or multiple Material Balance Area (MBA). Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 7

Managing Managing the NMAC System the NMAC System - - design of MBA design of MBA Facilities under IAEA safeguards, have already established MBAs that are agreed upon between the France and the IAEA. MBA 11 MBA 1 MBA 2 MBA 12 MBA 21 MBA 22 MBA 23 MBA 13 MBA 14 MBA 31 MBA 41 MBA 4 MBA 3 MBA 32 Smaller MBAs allow for better localization of a potential loss. For increased capability in general, smaller MBAs make control of nuclear material easier and reduce the size of the area to which an unauthorized removal or loss can be attributed. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 8

Key Features of Centralized Accounting Key Features of Centralized Accounting System System Real-Time Monitoring and Reporting within 24 hours. Independent Verification of material movements and inventories. Supports International and National Obligations. Ensures that all accounting declarations and reports are accurately prepared and submitted in a timely manner. Integrity and traceability of the inventory book and accounting book Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 9

Key Features of Local Accounting System Key Features of Local Accounting System Monitors operations at the facility level with multiple layers of oversight. Ensures meticulous recording, verification, and reconciliation of inventory changes. The process involves multiple layers of oversight, from operations monitored by the Nuclear Materials Custodian to data consolidation at the local level. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 10

Managing the NMAC Managing the NMAC - - Data processing Data processing Centralized National Accounting (State) State level National book inventory Nuclear Material Accountant OK Declarations MBA s Local accounting Control failed MBA s local Book inventory OK Nuclear Material Control Agent Facility level Physical nuclear management system Nuclear Material control OK Control OK Physical inventory Updating Records physical inventory Records match Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 11

Managing the NMAC Managing the NMAC - - Data detection of a gap between physical inventory and local accounting detection of a gap between physical inventory and local accounting Data processing processing Centralized National Accounting (State) State level National book inventory Nuclear Material Accountant Declarations MBA s Local accounting Control failed MBA s local Book inventory Control failed and data refused Nuclear Material Control Agent Facility level Control OK Physical nuclear management system Nuclear Material control 12 OK Records match Physical inventory Discrepancy between records physical inventory Updating Records Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA

Managing the NMAC Managing the NMAC - - Data processing detection of a gap between detection of a gap between local accounting and national local accounting and national accounting Data processing accounting Centralized National Accounting (State) State level National book inventory Control failed, data refused Nuclear Material Accountant Declarations MBA s Local accounting Control failed MBA s local Book inventory OK Nuclear Material Control Agent Facility level Control OK Physical nuclear management system Nuclear Material control 13 OK Records match Physical inventory Discrepancy between records physical inventory Updating Records Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA

Managing the NMAC Managing the NMAC - - Data processing detection of a gap between detection of a gap between local accounting and national local accounting and national accounting Data processing accounting e Centralized National Accounting (State) State level National book inventory d Nuclear Material Accountant f c declarations MBA s Local accounting control MBA s local Book inventory a Nuclear Material Control Agent g Facility level b Control OK Physical nuclear management system Nuclear Material control 14 OK Records match Physical inventory Discrepancy between records physical inventory Updating Records Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA

Hypothetical Case Study: A Potential Hypothetical Case Study: A Potential Diversion Thwarted Diversion Thwarted Background A Research & Development facility, focused on advanced nuclear research, operates under strict protocols to handle small amounts of nuclear material A used for experimental purposes. The facility is under both national and local accounting systems to ensure comprehensive oversight of nuclear materials. Incident example During a scheduled cross-checking verification performed by the Nuclear Material Custodian and the MBA s local accounting team, a discrepancy is identified in the reported inventory of nuclear material A. By comparing the data of the local book inventory to those of the physical inventory, a shortfall of a few grams of material A is found. The shortfall can not be reconciled with the facility s reported usage, transfers, or documented losses. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 15

Hypothetical Case Study: A Potential Hypothetical Case Study: A Potential Diversion Thwarted Diversion Thwarted Investigation Local Level Response: An immediate internal audit is conducted, involving review of batch records, surveillance data, and access logs. An unscheduled physical inventory is performed, revealing discrepancies in the records maintained by a department handling experimental samples. National Level Response: The State competent authority and national accounting team is informed within 24 hours. An in-depth review of all material A inventory records is conducted, using advanced data analytics to identify potential anomalies. The investigation confirmed that the local records matched the national records, focusing the investigation on the physical inventory of the facility. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 16

Hypothetical Case Study: A Potential Hypothetical Case Study: A Potential Diversion Thwarted Diversion Thwarted Detailed Examination: Data Inspection: Closer inspection using the confidentiality, integrity and availability approach revealed a technician manipulated records and altered data to conceal the removal of material A, diverting small amounts since the beginning of the month. Surveillance Evidence: Investigation supported by footage showing the technician accessing material A storage without corresponding experimental documentation. Comprehensive Verification: Verification complemented by access control investigations, administrative inquiries, and physical protection sensors records. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 17

Hypothetical Case Study: A Potential Hypothetical Case Study: A Potential Diversion Thwarted Diversion Thwarted Resolution Identification: The integrated NMAC system swiftly identified the technician, who was apprehended, and the diverted material A is recovered. Enhanced Security: Security measures are tightened, and additional protocols introduced for stricter monitoring and verification. Outcome: The case underscores the importance of meticulous record-keeping and advanced analytics in maintaining nuclear material accounting integrity, as well as the complementarity of the different protection and control measures for nuclear materials in the search for the causes of a deviation and the identification of potential malicious insiders. Local control team Sate control Facility operator National National accounting accounting And control And control European European Accounting Accounting and control and control Physical Physical controls controls Inventory Inventory records records Inventory Inventory book book Local Local accounting accounting Nuclear Material Custodian Local nuclear material accountant European Commission Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 18

Discussion Discussion Effectiveness of the Integrated NMAC System: The integrated NMAC system effectively detects and prevents unauthorized diversions through comprehensive oversight. Importance of Real-Time Monitoring: Real-time monitoring is crucial for timely detection of discrepancies, underscoring the need for continuous monitoring. Data Integrity and Advanced Technologies: Ensuring data integrity and leveraging advanced technologies, such as AI-powered surveillance analytics, are vital for enhancing detection capabilities. Challenges and Limitations: Delayed Detection: Monthly scheduled verifications may not be sufficient for timely detection. Record Manipulation: Vulnerabilities in data integrity protocols allow for manipulation without immediate detection. Surveillance Gaps: Post-incident reliance on surveillance footage highlights the need for proactive monitoring. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 19

Lessons Lessons Learned Learned and Discussion and Discussion Integration of Accounting Systems: Integrating national and local accounting systems provides comprehensive defense against insider threats, detecting both macro and micro discrepancies, detection of attempted fraud and procedure of deterrence. Real-Time Monitoring: Continuous real-time monitoring, regular audits, and strict access controls are essential measures, unscheduled physical inventory taking. Enhancing Data Integrity Protocols: Robust data integrity protocols, including enhanced encryption and automated anomaly detection, are critical to mitigating manipulation risks. Leveraging Advanced Technologies: Investing in AI-powered surveillance analytics and distributed ledger technology may enhanced, in the future, threat detection and prevention. Complementary Measures: Implementing effective alert systems, strengthening security culture, and providing training on anomaly detection and response protocols are crucial for continuous protection. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 20

References [1] IAEA, Use of Nuclear Material Accounting and Control for Nuclear Security Purposes at Facilities, IAEA Nuclear Security Series N.25-G. [2] IAEA, Preventive and Protective Measures against Insider Threats, IAEA Nuclear Security Series N.08-G (REV 1). [3] Eric GOSSET & al, Development and evaluation of security culture in a research and development organization - Brief overview development method at French CEA, assessment/test process, observations and lessons learned , International Conference on Nuclear Security: Shaping the Future 20-24 May 2024, Vienna, Austria [4] Marina Koren, Top Ten Cases of Nuclear Thefts Gone Wrong, Smithsonian Magazine, 2013. https://www.smithsonianmag.com/science-nature/ top-ten-cases-of-nuclear-thefts-gone-wrong-10854803/. [5] Romuald BON NGUYEN, French centralized nuclear material accounting: a tool at the heart of national security and safeguards implementation, Proceedings of the INMM & ESARDA Joint Annual Meeting Vienna, Austria from May 22-26, 2023. Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA 21

Thank you for your Thank you for your attention ! attention ! CEA FONTENAY-AUX-ROSES DSSN/SPPS carin.yota@cea.fr + 33 1 46 54 73 85

CEA/DSSN/SPPS Strengthening Nuclear Security in R&D Facilities : Integrating National and Local Accounting Systems to Counter Insider Threats 65th Annual Meeting of the INMM - July 21-25 PORTLAND OREGON - USA