7
7
7
7
Vigilance by staff and managers is recognised as a key facet of effective nuclear security culture by the IAEA, as is a proactive questioning attitude on the part of personnel. Although individual actions may be innocent in nature, reporting potentially suspicious incidents to a centralised security or human resources team helps to mitigate risks. Reporting also allows patterns of potentially suspicious behaviour to be analysed. As the people most likely to see staff behaviours, member of staff should also take responsibility for monitoring behaviour, not just the security team. As such, staff must be confident that action will be taken, but also that all reports will be treated sensitively and in confidence.
According to the IAEA’s Nuclear Security Series No. 7, ‘Nuclear Security Culture’, effective nuclear security culture is underpinned by an organisation’s beliefs and attitudes, namely that credible threat exists, and that nuclear security is important. Even small acts may have large consequences, particularly if they take place over prolonged periods, or could be exploited by third parties with malicious intent. The repeated failure to act against suspicious behaviour is indicative of poor nuclear security culture, and could be related to underlying factors such as motivation or the effectiveness of management and leadership.
Staff may feel that concerns are overplayed, or simply accept that certain individuals act in a peculiar way. For example, after considerable investigation Bruce Ivins was implicated in the 2001 Amerithrax attacks, where anthrax was posted to numerous high-profile individuals in the US. Ivins was an eccentric character with poor mental health. Although many people found this behaviour unsettling, they rationalised it as him being an eccentric and did not report their concerns. In total, five people died and 17 were injured from inhalational anthrax. In their study of the incident, Ketra Schmitt and Nicholas A. Zacchia estimate that total cost associated with decontamination was about US$320m.
It is noteworthy that not all observations are physical. For example, the NATO Cooperative Cyber Defence Centre of Excellence notes potentially suspicious online behaviours that IT administration should be aware of, including:
• Correspondence with competitors
• E-mail messages with abnormally large amount of data
• DNS queries which indicate involvement with internet underground
• Use of suspicious protocols
• Use of suspicious services
• Execution of offensive tools
• Execution of malware
• Anomalous peaks in outgoing connection count
• An unauthorised device is connected to the network
• Download of blacklisted software
• Connections initiated from a workstation outside working hours
Such factors could contribute to acts of sabotage, theft, fraud, espionage, or unintentional damage to a company’s staff, property or reputation.
However, unless a staff member is part of a security or human resources team it is important not to embark upon a ‘witch hunt’. Unauthorised investigations may disrupt a productive work environment and delicate issues should be handled by specialists.
Further Reading:
