By Eni Lamce, IAEA Department of Nuclear Safety and Security and Sarah Henry Bolt, IAEA Department of Nuclear Safety and Security
The IAEA recently issued its first implementing guide to comprehensively address computer security – Nuclear Security Series (NSS) No. 42-G Computer Security for Nuclear Security – to support experts worldwide in implementing computer security measures to strengthen their national nuclear security regimes.
“This guide will support Member States in strengthening computer security in their national nuclear security regimes, ensuring the benefits of digital technology can be embraced without weakening the regime and the capacity to protect, detect and respond to cyber threats,” said Director of the IAEA Division of Nuclear Security, Elena Buglova.
Computer-based systems play an essential role in all aspects of our lives, and this is no different when it comes to nuclear and related activities. These systems are used in a variety of ways in the nuclear industry to support the effective, safe and secure operation of facilities and activities engaged in using, storing and transporting nuclear and other radioactive materials.
Because of this key role, these digital systems can be an attractive target for terrorists and saboteurs. They could aim to exploit the potential vulnerabilities of a facility’s digital systems, which could lead to unauthorized access, disruption of operations, and even the sabotage of facilities or the theft of nuclear or other radioactive materials.
“Ensuring that these systems are secured against such acts, protects facilities from cyber-attacks and sabotage and bolsters other areas of the nuclear security by keeping, for example, physical protection and detection systems operational,” said Buglova.
The new publication highlights the need for and provides guidance on how to implement computer security as an integral component of a national nuclear security regime. The guidance supports the development and implementation of an integrated national strategy, regulatory approach, and adherent computer security programmes designed to protect computer-based systems, the compromise of which could adversely affect nuclear security or nuclear safety.
This guidance publication, as with all in the NSS, is produced by the IAEA in cooperation with Member States. Other publications in the NSS that touch upon computer security for nuclear security are NSS No. 17-T (Rev. 1) Technical Guidance on Computer Security at Nuclear Facilities, published in September 2021, and NSS No. 33-T Technical Guidance on Computer Security of Instrumentation and Control Systems at Nuclear Facilities.
Ceaseless vigilance
Preparing for and responding to a nuclear or radiological emergency
Peter Kaiser
The alert came just before sunrise in Vienna on 11 March 2011. The on-call emergency response manager reviewed the seismic report that opened on his laptop screen. Within minutes, staff trained in specialized response roles were called into the IAEA’s Incident and Emergency Centre (IEC). He had initiated the IEC’s ‘full response’ for the Fukushima Daiichi nuclear accident, based on the results of an assessment that followed pre-established procedures.
“Full response’ means that over 200 staff members trained in regular exercises operate in 12-hour shifts, 24 hours per day, gathering information from emergency contact points in the ‘Accident State’ — in this case, Japan — and other Member States, dispatching IAEA assistance when requested, informing the international community, while updating the media and public and coordinating the international response.
Next month, experiences and lessons learned from the accident, as well as achievements undertaken by national, regional, and international communities since, will be the focus of the International Conference on a Decade of Progress after Fukushima-Daiichi.
Being prepared for the unexpected is vital for developing the agility to respond to increasingly demanding circumstances.
A mandate to respond
During the intervening quarter of a century between the Chornobyl and Fukushima Daiichi accidents, the IAEA developed these emergency preparedness and response (EPR) ‘reflexes’, which include procedures, infrastructure, networks and know-how. Progressively during that intervening period, the IAEA expanded its response capacity. Six years before the Tohoku earthquake struck Japan, the IEC opened with a mandate to respond to nuclear and radiological emergencies regardless of whether they are caused by natural disasters, safety failures or malicious intent.
“The IEC is purpose-built to handle safety or security related emergencies, including extreme events, and to respond effectively regardless of the pressure,” said Head of the IEC from 2011 to 2020 who led the IEC’s response at that time, Elena Buglova.
A 20-year IAEA veteran and an expert in EPR, Rafael Martinčič served in the operational area of the IEC during the marathon 1300-hour-long response to the Fukushima Daiichi accident. “For me, the key EPR lesson learned in that response is to emphatically re-emphasize the principle that all countries need to share with each other, and with the IAEA, information on their own protective and other response actions,” Martinčič recalled.
Sharing information supports a consistently effective response and enables governments to provide interested stakeholders “a clear and understandable explanation of the technical basis for decisions on protective actions and other response actions, which is crucial in increasing public understanding and acceptance at both the national and international levels,” Martinčič said.
Major exercises, such as the world’s largest and longest international exercise, the Level 3 Convention Exercise (ConvEx-3), offer a window into countries’ ability to share information about their protective actions in the midst of an emergency. “Every exercise clearly shows how far we have come in the past decade and how far we have yet to go in learning this essential lesson,” Martinčič said.
A decade of innovation
Without hesitation, Elena Buglova can name what could have been done differently in the IAEA’s response to the Fukushima Daiichi accident, “ideally, the IAEA would have received from Member States, well in advance of this severe accident, a mandate beyond just receiving, verifying and exchanging information. We would have been best prepared if we had had an additional, explicit mandate to develop and share the IAEA’s assessment of the information, and, as feasible, provide a prognosis for the future progression of the accident.”
The IAEA’s response role at the time of the Fukushima Daiichi accident did not include providing a prognosis of the potential evolution of an accident or an assessment of the possible consequences. Following the emergency response, Member States acknowledged the benefits of such informed analysis to support their own national safety determinations. The IAEA General Conference granted the IAEA a mandate to provide this assessment and prognosis. “To this day, we continually reach out to Member States to exercise how the IEC will assess an accident in the midst of an emergency response and how this assessment serves to strengthen the effectiveness of that response,” Buglova said.
The IAEA also issued new international safety standards and established a dedicated EPR Standards Committee, EPReSC, in 2015. “EPReSC is the global forum that continually focuses attention on EPR, not just in the aftermath of an accident. At EPReSC, the Safety Standards Committee with the largest membership, countries from around the world can share protection policies and methods to be certain that as many countries as possible can strengthen their response in line with internationally recognized best practice,” Buglova said. One of EPReSC’s benchmark achievements is the adoption of Preparedness and Response for a Nuclear or Radiological Emergency (IAEA Safety Standards Series No. GSR Part 7), the IAEA safety standard with the largest number of co-sponsoring international organizations.
Preparing for tomorrow’s emergencies today
As the current COVID-19 pandemic vividly demonstrates, tomorrow’s emergencies will likely increase in complexity, characterized by different combinations of triggering factors and response considerations. Being prepared for the unexpected is vital for developing the agility to respond to increasingly demanding circumstances, Buglova said.
“As someone said, ‘luck favours the prepared’. We don’t see our job quite that drastically, but we do go out of our way to create challenging exercises. Failure is inevitable if you do not plan. But only an exercise will prove the plan’s effectiveness,” Buglova said.
The IEC and over 200 trained staff registered on the IAEA’s Incident and Emergency System prepare daily for that call to respond as swiftly and effectively as possible.
