K
K
K
K
Information security is as important as physical security, and the theft of intellectual property from a nuclear site is both a commercial and proliferation risk. Studies by the US Nuclear Regulatory Commission suggest that two thirds of insider incidents site analogous to a nuclear facility required ‘covert activity’ i.e. ‘the insider was unable to carry out the crime in the presence of others without arousing suspicion’.
Perhaps the most notorious example of intellectual property theft at a nuclear facility is the case of Abdul Qadeer Khan (often referred to as A. Q. Khan). Between 1974 and 1975, Khan stole nuclear secrets from the URENCO uranium enrichment consortium in the Netherlands, and transferred these to Pakistan for its nuclear weapons’ programme. Khan later went on to supply nuclear technology to Iran, Libya and North Korea. Despite his suspicious working patterns – including working late and taking documents home with him – being flagged to security, little was done at the time to prevent Khan’s actions.
Although there may be legitimate reasons for working late, staff should still notify security of such arrangements, as well as observe their colleagues working at irregular hours. Furthermore, sensitive information should be used and kept in accordance with your organisation’s policy. The UK’s Centre for the Protection of National Infrastructure (CPNI) lists engagement in unusual copying activity, engagement in unusual IT activity, unauthorised handling of sensitive material and commitment of security violations as ‘of particular interest (and predictive of case type) when frequent signs were shown and the employee was unlikely to have an adequate explanation’. The IAEA’s Implementation Guide No. 23-G, ‘Security of Nuclear Information’ includes guidance on procedures for handling sensitive information [Section 6.14].
Assuming the need to work on project is legitimate, long hours can be a sign of poor working culture and that management needs to provide additional support. Operators may wish to consider computer systems that register staff presence on-site, and that also identify staff working overly long hours or irregular hours.
In most cases, however, it is not the responsibility of staff member or contractors to conduct their own investigation. Rather, it recommended that such incidents are reported to the organisation’s security or human resources team who can record the incident and investigate wider behaviours. Nuclear organisations should consider establishing human resources or security teams where matters can be reported in confidence, and where employees may seek direction for financial or medical assistance.
Further Reading:
