One of the biggest challenges in protecting sensitive facilities, materials and information from terrorists is the “insider threat.” All the guns, guards and gates in the world can be rendered useless if individuals with malevolent intentions can get unrestricted access to facilities under false pretenses, or individuals with access are recruited for terrorist causes.
The recent cases of Washington Navy Yard shooter Aaron Alexis and National Security Agency (NSA) whistleblower Edward Snowden have illustrated the vulnerability of the most highly secure facilities and systems to insiders.
The Two-Person Rule
The nuclear realm is no exception. Effective prevention of nuclear terrorism—that is, protecting against the theft or diversion of nuclear weapon-usable materials by non-state groups—depends crucially on mitigating the insider threat.
Given this danger, it is difficult to comprehend a recent decision by the Nuclear Regulatory Commission. NRC commissioners rejected the advice of their staff and indefinitely tabled consideration of a new requirement that could greatly reduce the insider threat at U.S. nuclear facilities handling nuclear weapon-usable and other sensitive nuclear materials.
In 2011, as part of a package of revisions to NRC requirements for material control and accounting at the nuclear facilities that it regulates, the NRC staff proposed that the agency introduce a “two-person rule” “to make the unauthorized diversion of material less likely.” The two-person rule would ensure that “two qualified and authorized individuals are present” when working with sensitive nuclear materials, such as transferring or handling materials, placing seals on containers, or conducting inventories.
A two-person rule is a commonly used anti-insider security measure that ensures that a lone individual never has the opportunity to steal material or take other actions to facilitate a theft without being observed. A two-person rule cannot provide complete protection against insider conspiracies involving more than one person, but it can make life more complicated even for small groups of insiders. It’s such a good idea that the Department of Energy has had a two-person rule at its facilities for decades. Regardless, the NRC has never imposed an explicit, comprehensive two-person rule, even for facilities handling such strategically important quantities of weapon-usable materials as plutonium or highly enriched uranium.
The NRC Needs a Two-Person Rule
The NRC staff has estimated that the cost of implementing a two-person rule at the small number of Category I facilities that it regulates—two plants that manufacture highly enriched uranium fuel for naval reactors and the plutonium mixed-oxide fuel fabrication plant under construction in South Carolina—would be a mere $165,000. For eight other less sensitive facilities, including uranium enrichment plants, the total cost would be about $550,000. Yet even this relatively small price for a big security gain is apparently too much for the nuclear industry to swallow. The NRC staff noted that “existing licensees have expressed concern about the potential impact of the two-person rule.”
The industry’s complaints appear to have found a receptive audience at the NRC, specifically commissioners Kristine Svinicki and William Magwood, who questioned the value of the two-person rule provision and voted to exclude it from the draft regulation. They were in the minority at that time, however, and the commissioners ultimately approved publication of the draft rule in the Federal Register for comment. Even so, the commissioners also told the NRC staff to either subject the two-person rule and other proposed changes to a cost-benefit analysis under the NRC regulation called the “backfit rule” or explain why the backfit rule does not apply.
The staff maintained that they were merely following precedent: The NRC had not applied the backfit rule to new material control and accounting regulations in the past. In fact, there is no sensible way to perform a quantitative cost-benefit analysis if the benefit is preventing the theft of sufficient material to make a nuclear weapon. The benefits are self-evident, and the costs are minimal.
Nevertheless, in 2013 the commission—including the new chairman, Allison Macfarlane—reversed its previous decision and blocked publication of the draft, voting that the staff had to do a backfit analysis on the two-person rule. The commissioners also said that if the staff didn’t want to hold up the rest of the rule while it did the analysis, they could simply drop the two-person provision and defer it to an unspecified future date. That’s what the staff decided to do in the Federal Register notice published on November 8: postpone the decision, possibly forever.
The NRC is not the only federal agency that lacks a common-sense two-person rule. Even the NSA apparently didn’t have such a rule governing access to highly classified information. In the wake of the Edward Snowden fiasco, it finally made a commitment to implement one.
Unfortunately, the NRC has not gotten the message. Let’s only hope that the agency doesn’t have to experience a similarly disastrous wake-up call before it appreciates the need to strengthen measures to thwart an inside job at U.S. nuclear facilities.