9
9
9
9
Nuclear security has traditionally emphasised the importance of physical security measures to protect nuclear and radiological materials and systems. Yet it is just as important to develop measures to protect sensitive information – particularly given that certain types of information could aid an adversary in successfully conducting an act of theft or sabotage. In a so-called ‘blended attack’, valuable information might include description of a site’s physical layout or security measures, timetables of material shipments and certain information on staff (or of their relations) that could be to leave them vulnerable to identification and exploitation by external groups.
More broadly, nuclear organisations also contain sensitive and proprietary information such as intellectual property that could cause economic damage if released. In 2007, several break-ins occurred at the Pelindaba Nuclear Research Center in South Africa. Although these were dismissed by the authorities as simple burglary attempts, there is widespread speculation that Chinese actors sought to obtain access to South Africa’s Pebble Bed Modular Reactor technology. This speculation increased after China appeared to move ahead with its own version of the technology following the incident.
Release of information may also cause reputational damage. For example, a leak of confidential data from Sony Pictures through a malware attack in 2014 caused widespread reputational damage to the company. The release of classified US communications by Wikileaks led to uncomfortable scrutiny of US relations with partners around the world, and also posed potential security risks to the US military. Information security violations are more likely that physical violations.
According to the UK’s Centre for the Protection of National Infrastructure (CPNI), of the 120 UK-based non-nuclear insider case studies studied between 2007-12, 47% included the unauthorised disclosure of sensitive information to an external party. Similarly, in 2014, 67% of US critical infrastructure companies surveyed by the US Ponemon Institute reported that they ‘had at least one security compromise that led to the loss of confidential information or disruption to operations’ the previous year. Given the increasing role of automated processes in operations, it is likely that information security will play a role of increasing importance, alongside physical security measures.
Information security measures should be based on the principles of confidentiality, integrity and availability. However, as noted by the IAEA, ‘While confidentiality is often singled out, organizations should ensure that their information security programme addresses all three attributes.’
Loss of confidentiality and the release of sensitive information could affect the safety and security of staff, and their families. For example, releasing names or addresses might allow third parties to identify where staff live, and make them susceptible to surveillance and blackmail. In 2016, Belgian police found that a nuclear expert had been filmed by the Islamic State terrorist group, and they suspect that the organisation was seeking to blackmail the expert and force him to be an inside threat. Similar information could also increase risk of fraud, with scammers pretending to be high-level members of staff ordering and authorising fraudulent payments.
Loss of integrity or availability can also negatively affect nuclear security, in the same way as loss of confidentiality. For example, the surreptitious altering of data could undermine scientific integrity of individual research projects, or contribute to safety or security incidents where adulterated data is inadvertently used. Indeed, as more processes are automated, if the information used by Programmable Logic Controllers (PLCs) is compromised, there might be ‘real world effects’ that cause damage to machines and experiments, or even trigger safety issues.
Loss of availability so that data and systems are no longer up and operational when they are needed can have massive disruptive effects to an organisation’s running and reputation. Losing data availability can have long-term impacts on research, for example by deleting years of results. Where access to data is for use by external parties, loss of availability can have commercial and reputational implications – particularly where they are a frequent occurrence.
Further Reading:
Jordan, W., Spy Cables: 'China behind S Africa nuclear break-ins', Al Jazeera, 25 February 2015
Myre, G., ‘How Much Did WikiLeaks Damage U.S. National Security?’ NPR, 12 April 2019
