Former NNSA Deputy Administrator Blasts UT-Austin Nuclear Power Plant Security Study

Jerry Paul

Earlier this week, Jerry Paul, a former deputy administrator at the National Nuclear Security Administration, took aim at a study that came out of UT-Austin in August concerning nuclear power plant security.

The following passage comes from an op-ed that appeared in the Fort Worth Star-Telegram.

These are dangerous times. Nuclear security is a serious topic. It calls for assessment by serious people willing to do the hard work of real research.

There is nothing wrong with an academician or anyone else, including political activists, raising questions about public topics including security and even nuclear security. But it should be done in a responsible way and should be based on facts.

If conclusions are to be marketed as university “research,” they should be backed by credible data, authoritative sources’ expertise and peer reviews by unbiased experts.

Merely using the word “nuclear” in a title should not qualify written work for a lower standard of academic or journalistic scrutiny.

Previously, NEI issued a statement critiquing the study, noting many of the same point. NEI's John Keeley wrote a blog post of his own on the day of the report's release:

[A] report like the NPPP's today also fails to acknowledge that the very type of terrorist attack alleged as a vulnerability necessarily represents an enemy of the state incursion within our country. It isn't the obligation of any electric utility to defend against that; that's a job for the highest levels of federal national security.

For more on plant security, please consult NEI's website.

Read More

Department of Defense Makes it Official: It Never Requested Nuclear Security Report from Nuclear Proliferation Prevention Project

Even though the mainstream media has moved on to other topics, there are still a number of other facts we've uncovered concerning the Nuclear Proliferation Prevention Project and its supposed relationship to the Department of Defense (DoD). Earlier this week, a reporter from NEI's Nuclear Energy Overview made a phone call to the Pentagon to get some clarification about the exact relationship between DoD and the published report. Here's an excerpt:

The U.S. Department of Defense did not request or validate a recent study on security at America’s nuclear energy facilities by the Nuclear Proliferation Prevention Project, a DOD official said.

“The Department of Defense did provide funding to the University of Texas at Austin, but did not request a report on that specific topic, nor did we validate its findings,” the Defense Department official said.

That's what we all suspected, but it's nice to get it on the record. We'll have more if events warrant.

Read More

Some Final Thoughts on the Nuclear Plant Security Report by Nuclear Proliferation Prevention Project

As our readers will recall, we spent a considerable amount of time last week responding to a "study" issued by the Nuclear Proliferation Prevention Project on the security of nuclear energy facilities here in the U.S. Over the weekend, Jim Conca, a blogger for Forbes, took a closer look at the report, and made a number of interesting points (emphasis added in bold):

Those of us who have actually worked within the nuclear complex can tell you this study is grossly flawed. You need only read the limited source materials the author used in making her case and the absence of any references that contradict her thesis. And the lack of any expert review.

But if you read the press on this report, it sounds like it was actually commissioned by the “Office of the Secretary of Defense, which provided financial support for the research”. Inquiries to DoD say the report was not requested by the department. DoD just funds the program as a whole at the University and has no knowledge what’s coming out, until it’s out. We all know how this works.

There was no expert peer review, and the report only represents speculations of the student and her advisor. Even the cartoon on the front page is childish. The authors confuse nuclear weapons with nuclear energy, and have no first-hand knowledge of the security aspects of these facilities, since they have no access to such highly classified information.

But hey, just wing it! What could go wrong?

What’s stranger yet is that UT has an amazing number of nuclear experts, any one of whom could have reviewed this report, if asked. UT even has Dale Klein, former NRC chairman and nuclear security expert at the Pentagon (March 5, 2010 Speech). Why was he purposefully ignored?

One other important point that the media missed: Alan J. Kuperman, the head of the Nuclear Proliferation Prevention Project, isn't a neutral academic. In fact, he used to work for the avowedly anti-nuclear Greenpeace. The reference is included in his online bio.

One wonders why that reference wasn't mentioned during last week's media frenzy.

Read More

NEI Responds to NPPP Report on Security at U.S. Nuclear Power Plants

A few minutes ago, NEI issued a statement concerning the security of the nation's 100 operating nuclear reactors. The statement comes in response to the release yesterday of a report by the Nuclear Proliferation Prevention Project. Here's the nut graf:

A report by a graduate research assistant at the University of Texas’ Nuclear Proliferation Prevention Project, released Aug. 15, is an academic paper developed for discussion among academia of the appropriate security levels at nuclear energy facilities. It is not a full assessment of security, nor does the author of the report have access to the safeguarded information that she would need to make such as assessment.

Like many such evaluations that examine the potential theft of uranium fuel from commercial reactors, the NPPP report fails to explain how attackers would be able to dislodge highly irradiated uranium fuel—800 to 1,200-pound, 18-foot-tall fuel bundles—and maneuver them from reactors, storage pools or steel and concrete containers past layers of elaborate security.

See our website for more information on nuclear power plant security.

Read More

A Fresh Perspective on Nuclear Plant Security

Nuclear plants are widely acknowledged to be the best-defended facilities among the nation’s critical infrastructure. Critical, independent security experts share the industry’s belief that nuclear power plants are very well-defended, particularly in comparison to other elements of the nation’s industrial infrastructure. These include assessments from the the U.S. Federal Bureau of Investigation and the U.S. Department of Homeland Security.

The robustness of our industry's security isn't the easiest topic to address in great detail; appropriately, key security features for our sites are Safeguards Information. Still, this NEI video treatment of site security does offer some much-needed perspective relative to reports like today's from Nuclear Proliferation Prevention Project (NPPP).

There's a common/recurring flaw in many such evaluations of nuclear plant security: they ever fail to explain how attackers upon a nuclear power plant will be able to dislodge highly irradiated fuel, stored in tons-weighing 18-foot tall assemblies in reactors, pools, or in megaton dry casks, and maneuver them past layers of elaborate security measures.  

It's also important to remember that the U.S. Nuclear Regulatory Commission holds nuclear power plants to the highest security standards of any American industry, and industry exceeds those standards.

Approximately 9,000 extremely well-armed and highly trained security officers defend the nation’s 62 nuclear power plant sites. This is an increase of approximately 60 percent in the size of nuclear plant security forces since 9/11. These forces, a large percentage from military and law enforcement backgrounds, are drilled and tested regularly to ensure their readiness. Security officers receive hundreds of hours of training before they are deployed.

“Force on force” exercises that use dedicated teams of mock adversaries who specialize in attack strategies and tactics are part of the comprehensive oversight of industry security programs. Each plant site conducts quarterly and annual drills for each security team and undergoes an NRC-evaluated “force on force” exercise once every three years. Ongoing integrated response with federal, state and local law enforcement agencies ensures robust and extensive site protection plans. Based on its regular interactions with federal intelligence and law enforcement authorities, the NRC establishes the threat against which the industry must be protected and sets stringent standards that security forces must meet.

"U.S. nuclear plants were safe and secure before Sept. 11, 2001," Dave Kline, NEI's Director of Security, told me this morning. "They are even safer and more secure today, on the strength of more than $2 billion in additional security investment encompassing substantial physical changes and enhancements at plant sites; the hiring of thousands of additional, highly trained security officers; procurement of more sophisticated detection and access systems; and closer coordination with local, state and federal law enforcement, intelligence experts, and the military."

Some key considerations to keep in mind as you weigh allegations of lax security lobbed by academics versus the time-tested, ongoing assessments of this nation's top-ranking security professionals:

• Every commercial nuclear reactor in the country has conducted an aircraft impact assessment. 
• Industry's Design Basis Threat is reviewed periodically, and threat information is considered for DBT revision. DBT is Safeguards information, and as such can't have its attributes characterized.
•  Frequent Beyond Design Basis Threat drills are conducted, confirming margin in the protective strategies. 
• Contingency planning is in place for loss of large areas of a plant.  

Finally, a report like the NPPP's today also fails to acknowledge that the very type of terrorist attack alleged as a vulnerability necessarily represents an enemy of the state incursion within our country. It isn't the obligation of any electric utility to defend against that; that's a job for the highest levels of federal national security.   

Read More

Partnerships and Information Sharing in President Obama's Executive Order on Cyber Security

President Obama at 2013 SOTU

Yesterday President Obama signed an Executive Order aimed at helping nation harden its critical infrastructure against cyber attacks, and introduced it to the nation as part of his State of the Union address.

The Order states, "We can achieve these goals through a partnership with the owners and operators of critical infrastructure to improve cybersecurity information sharing and collaboratively develop and implement risk-based standards."

The partnership model has a history of success, and it is prudent to continue and support this model.

The nuclear power industry has an active partnership with the U.S. Department of Homeland Security specifically geared toward enhancing the security of commercial users of nuclear materials.

Under HSPD-7, the industry established the Nuclear Sector Coordinating Council (NSCC), and the government established the Government Coordinating Council (GCC).  These groups meet quarterly under the Critical Infrastructure Partnership Advisory Council (CIPAC) framework.

The NSCC/GCC provides an instrumental forum for organizations engaging in civilian uses of nuclear materials in the U.S. to discuss security issues and work together with our federal partners to enhance security and resilience.

The order also discusses the importance of information sharing. I could not agree more. The nuclear power industry in the U.S. has a proven record of responding in a timely manner to identified threats to the safe operations of our facilities.


Information sharing is integral to establishing a robust cyber security program. As I discussed in a previous blog post on nuclear power plant cybersecurity, our plants have been actively addressing the cyber threat for over 10 years.

The first questions that must be answered when establishing a security program are:

1. What must be protected?
2. What must it be protected from?

Information sharing has been instrumental in helping us stay on top of what we must be prepared to defend against.

Under the NSCC/GCC framework, the nuclear sector receives quarterly threat briefings at the SECRET level. The DHS also conducts monthly sector-specific unclassified threat briefings.

So, at a high level, the EO is moving in the right direction. But we cannot lose sight of good work already done.

This new emphasis on the adoption of cyber security practices must consider the existing regulatory frameworks and voluntary initiatives that are already in place.Complexity is the enemy of security. Streamlining and minimizing burden on private entities ensures that resources remain available to respond to real threats.

Ensuring that any new cyber security guidance, practices, or policies does not overlap or duplicate existing practices is essential. For addition details, please consult the NEI backgrounder on Cyber Security.

POSTSCRIPT: The Nuclear Energy Institute’s chief nuclear officer and senior vice president, Anthony R. (Tony) Pietrangelo, made the following comment about the cyber security executive order signed Tuesday by President Obama.

Tony Pietrangelo

“Commercial nuclear energy facilities are well protected from possible cyber threats. The nuclear energy industry has been implementing and improving cyber security controls since 2002, and the federal agency that oversees the nation’s nuclear energy facilities—the Nuclear Regulatory Commission—has established regulations that thoroughly monitor and inspect cyber security at all U.S. reactors.

“To ensure our constant readiness, the industry participates with government agencies to be aware of and assess its readiness for emerging cyber threats. Our facilities are essentially cyber islands, in that safety and control systems are not connected to business networks or the Internet. Unlike industries for which two-way data flow is critical, nuclear power plants do not require incoming data flow.

“Nuclear plants also are protected from grid instability, with multiple backup power supplies that provide for safe shutdown of a reactor in the event of a power blackout. Given that the NRC appropriately exercises authority over the protection of nuclear plant systems from potential cyber threats, it would be counterproductive to have dual oversight of these facilities.”

Read More