Punitive measures are actions taken to reprimand an individual or a group who have failed to comply with regulations. These measures may also be used as a wider deterrence against poor or unacceptable behaviour. However, on their own, punitive measures cannot positively reward or encourage good behaviours and therefore, while they may be useful in generating compliance, are less likely to induce security-conscious behaviour. In this sense, punitive measures are necessary but not sufficient for ensuring effective nuclear security.

Moreover, management can only determine whether punitive measures are required when events are brought to their attention. General deterrence theory suggests that an individual may commit a crime if the expected benefit outweighs the cost of action. According to this school of thought, punitive measures are essential to ensuring effective nuclear security. However, insiders may have more complex reasons for their actions and thus managers require additional tools.

For example, in its assessment of Robert Hanssen, a senior FBI analyst convicted of espionage in 2001, the US Department of Justice noted that Hanssen’s initial decision to engage in espionage ‘arose from a complex blend of factors, including low self-esteem and a desire to demonstrate intellectual superiority, a lack of conventional moral restraints, a feeling that he was above the law, a lifelong fascination with espionage and its trappings and a desire to become a ‘player’ in that world, the financial rewards he would receive, and the lack of deterrence—a conviction that he could ‘get away with it’. Hanssen exhibited many traits that should have raised suspicions, but he was able to use his authority and position to disrupt the investigation against him.

In all but the most obvious cases within an organisation, an effective nuclear security culture can help detect suspicious behaviour. Nonetheless, the effective use of authority requires a reporting chain wherein events are brought to management’s attention, and behaviours can be judged against a set of clearly defined expectation and practices. Organisations must ensure that their organisational and institutional processes effectively capture and assess ‘red flags’, and that all staff are regularly assessed for their reliability. Work by Matthew Bunn and Scott Sagan (2017) shows how organisational and institutional processes may provide perverse incentives that distort accurate reporting and assessments.

Given the importance of staff members as a source of information, clear reporting procedures are also essential. Vigilance and effective reporting are unlikely where there is a culture of merely meeting minimum standards; rather, security-conscious behaviour should be encouraged.

In addition to regular training and sensitisation drives, to encourage appropriate behaviour and discourage inappropriate behaviour, a manager’s overall toolkit should consist of both positive and negative inducements. Positive inducements do not need to be large. They might include small measures such as recognising the contribution of individuals in an organisation’s newsletter, providing feedback on action taken on reported incidents, and entering staff who report potential incidents into a lottery.

Further Reading:

International Atomic Energy Agency (IAEA), Nuclear Security Culture, IAEA Nuclear Security Series: Implementing Guide, No. 7, Vienna, 2008

Bunn, M., and Sagan, S.D., ‘A Worst Practices Guide to Insider Threats: Lessons from Past Mistakes’, Cambridge, Mass.: American Academy of Arts and Sciences, 2014

U.S. Department of Justice, A Review of the FBI’s Performance in Deterring, Detecting, and Investigating the Espionage Activities of Robert Philip Hanssen, August 2003

Bunn, M., and Sagan, S.D., Insider Threats, Cornell University Press, 2017