Experiences in Nuclear Security Culture Brazil U S

Experiences in Nuclear Security Culture: Brazil -U. S. Workshop on Strengthening the Culture of Nuclear Safety and Security Michael O’Brien, Associate Program Leader August 2014 LLNL-PRES-658863 Lawrence Livermore National Laboratory is operated by Lawrence Livermore National Security, LLC, for the U. S. Department of Energy, National Nuclear Security Administration under Contract DEAC 52 -07 NA 27344.

Nuclear Security Culture Guidance (1 of 2) Nuclear Security Culture The assembly of characteristics, attitudes, and behaviors of individuals, organizations, and institutions that serves as a means to support, enhance, and sustain nuclear security INFCIRC/225/Revision 5 Fundamental Principle F All organizations involved in implementing physical protection should give due priority to the security culture, to its development and maintenance necessary to ensure its effective implementation in the entire organization CPPNM Amendment Physical Protection Regime Lawrence Livermore National

Nuclear Security Culture Guidance (2 of 2) Security Culture – NSS-07 “The assembly of characteristics, attitudes, and behaviour of individuals, organizations, and institutions which serves as a means to support and enhance nuclear security. ” Based upon: • Compartmentalization • Secrecy/Confidentiality • Classification Lawrence Livermore National Relies heavily on the trustworthiness, honesty, and integrity of individuals not to perform malicious acts.

Synergy Between Safety and Security § Shared principal objective of “the protection of people, society, and the environment from the effects of harmful nuclear radiation” § Shared Attributes: • Recognized values • Leadership needed for success • Accountability • Systematic approaches to actions • Learning and experience driven • Best when fully integrated into the system Both require a coordinated approach Lawrence Livermore National

Key Considerations - Nuclear Security Culture § Only as good as people responsible for nuclear security § Organizational nuclear security culture is influenced by: • International community • State regulations • Public support • Organizational norms • Underlying beliefs and attitudes • Principles that guide decisions and behaviours • Management systems • Behaviours of leaders and employees Lawrence Livermore National

Operational Considerations Administrative measures used in the security culture process: – Identify trustworthy employees during pre-employment process – Ensure employees understand their security responsibility – Select the most trustworthy employees for sensitive positions – Minimize opportunities for malevolent action by employees through procedural measures – – – Restrict area access to those needing it for job duties Separation of duties Manage/limit authorities with two person validation – Maintain positive work environment – Emphasize safety and security integrated awareness in work environment – Empower employees to act when questionable circumstances are encountered Lawrence Livermore National

Insider Protection System Considerations § Deterrence • Cannot quantify effectiveness § Detection • Insiders may be able to bypass technology • Detection of Insiders includes more non-technical means § Delay • Insiders may be authorized access past many barriers • Insiders may have special knowledge and opportunities to defeat barriers • Insider protection relies more on non-technical means § Response • Includes safety, security, and operations • Passive insider – usually no detection before the act • Response to Insider activities generally is by co-workers Lawrence Livermore National

Indicators of a Weak Nuclear Security Culture 1 of 2 • Lack of threat awareness • Lack of security visibility • Different security environment for different people at the same position • Security exceptions for managers • Disregard for security rules/personnel • Ambiguous security roles and responsibilities • Poor operational security • Lack of quality assurance program • Substitution of inferior equipment • Unskilled personnel • Deficiencies in acceptance testing Lawrence Livermore National

Indicators of a Weak Nuclear Security Culture 2 of 2 • Poor record keeping • Material inventories • Configuration management • No, or infrequent, security training, • • • exercises Poor information/cyber security Lack of graded approach Poor documentation Unprotected emails Inadequate password protection Cultural biases • Ethnic • Traditional Lawrence Livermore National

A Case in Point 1 of 2 Ernest Moniz: Y-12 National Security Complex Breach Was 'Unacceptable' Lawrence Livermore National

A Case in Point 2 of 2 "On the same night last week that four robbers shot an emergency officer at Pelindaba" — South Africa’s most important atomic facility — "another attempt was made to bypass the nuclear site’s security, " according to The Sowetan. [11. 13. 07] Lawrence Livermore National

Indicators of a Strong Nuclear Security Culture 1 of 2 • Defined security policies and procedures – Well documented – Understood – Periodic training conducted • Pertains to all levels of management • Management follows the procedures • Employees understand the threat is real and changes in security procedures may be necessary • Employees feel empowered to stop work when suspected malevolent actions are observed Lawrence Livermore National

Indicators of a Strong Nuclear Security Culture 2 of 2 § Mechanism exists for addressing security concerns § Employees understand their security roles § Suspicious activity reporting program exists § Employees report suspicious activities Lawrence Livermore National

Special Consideration - Security Awareness Program • A program intended to remind employees • • of their security roles and responsibilities Usually part of routine periodic employee training Sensitizes employees to watch for and report or interdict potential malevolent actions Spans the spectrum of concerns – Cyber, physical protection, MC&A, information, etc. A product of a strong security culture Lawrence Livermore National

Special Consideration – Human Reliability Program § Implemented using a Graded Approach § Usually restricted to persons in job areas which have greater capabilities to commit serious malevolent acts § Includes activities such as frequent drug screening, financial reviews, supervisor and co-worker observation § Periodic physical and mental evaluations § Periodic full background checks § A product of a strong security culture Lawrence Livermore National

Summary § Security culture is based on appropriate “behaviors and “attitudes” essential to nuclear security § The behavior of individuals directly involved in security is characterized by: • A rigorous, prudent approach; • A constant vigilance and a questioning attitude; and • A speed of reaction when faced with an unexpected situation § The attitude of non-security individuals is characterized by: • A knowledge of the principles of protection and taking them into consideration; • A compliance with rules and procedures; and • A questioning attitude to abnormal acts or events Lawrence Livermore National