Wearing passes outside of a nuclear site offers adversaries the opportunity to identify a staff member and potentially their family members. There is also a risk that malicious actors might duplicate staff passes in order to gain site access or leave staff vulnerable to manipulation via Social Engineering. This also applies to other forms of pass such as access and parking badges displayed in cars.

Analysis by the US Nuclear Regulatory Commission suggests that, in general, most adversaries are risk adverse and that an overt armed assault on a nuclear facility is ‘one of the least likely methods’ of gaining access to a site. However, this is because ‘terrorists usually choose to approach their targets without resorting to arms, preferring to display firepower only once inside and in control of a facility’. Fake passes may allow unchallenged access onto the site where materials may be accessed or stolen, while identification of staff members or their family opens the possibility of blackmail through kidnapping or intimidation.

At the extreme, there have been cases where armed groups around the world have attacked military sites whilst wearing military uniforms. Another case in 2004 involved family members of two bank managers being kidnapped by thieves impersonating policemen and used to coerce the bank managers into granting vault access.

The UK Centre for the Protection of National Infrastructure’s (CNPI) Work Place Behaviours seeks to sensitise companies to the impact of appearing to have poor security and change behaviours. The campaign addresses seven behaviours and ‘Staff not wearing their pass in the office or forgetting to remove it when they leave work’ is top of the list. Individuals can be politely reminded of a site’s security policy, although persistent non-compliance should be escalated to management.

Further Reading:

Mullen, S., ‘Generic Adversary Characteristics and the Potential Threat to Licensed Nuclear Activities from Insiders’, Defense Nuclear Agency Nuclear Security Division Washington, D.C. Proceedings of the Sixth Annual Symposium on the Role of Behavioral Science in Physical Security, Springfield, Virginia, AD-P003 374, 3-4 June 1981

Lafleur, J.M., Purvis, L.K., and Roesler, A. W., ’ The Perfect Heist Recipes from Around the World’ Sandia Report', SAND 2014-1790. Sandia National Laboratories, Livermore, California, 2015

Reuters, Sri Lanka on alert for attacks by militants disguised in uniforms’, The Strait Times, 29 April 2019

Faiez, R., Associated Press, ‘Militants wore US military uniforms in attack in Afghanistan’s capital’, Military Times. 30 May 2018

Gallagher, P., ‘Pakistani army frees hostages after militant attack’, The Observer, 11 October 2009

Centre for the Protection of National Infrastructure (CPNI) ‘Workplace Behaviours’, website of CPNI

Messier, R., Certified Ethical Hacker Study Guide, CEH v10 C, John Wiley & Sons, Inc., Indianapolis, Indiana, 2019