Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 61
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop 7 Threats to Civil Nuclear-energy Facilities John P. Holdren The possibility that civil nuclear-energy facilities might become targets for terrorists has been recognized since long before the attacks of September 11, 2001, on the World Trade Center and the Pentagon.31 The principal attraction of civil nuclear-energy facilities32 as terrorist targets lies in the potential for creating a release of radioactivity large enough to produce significant casualties and land contamination. Destruction of an important piece of energy-supply infrastructure in the targeted country and the possibility that a successful attack would lead to the wholesale shutdown of nuclear-energy facilities around the world might be seen as collateral “benefits” by terrorists. Obstacles are in place to prevent successful attacks on civil nuclear-energy facilities. First, multiple security barriers would need to be breached in order to generate a large release of radioactivity. Second, guard forces and other entry barriers complicate the task of terrorists seeking to penetrate a facility in order to try to blow it up or otherwise create a containment-breaching event from within. In addition, the “hard target” characteristics of most nuclear-energy facilities make them challenging to destroy from the outside with the types of weapons terrorists are most likely to have at their disposal, namely rocket launchers, mortars, light aircraft packed with explosives, and hijacked airliners used as cruise missiles. This presentation begins by locating the threat of attack on civil nuclear-energy facilities in the larger terrain of nuclear-terrorism dangers. It goes on to describe the potentially dire consequences of a successful attack, to discuss the range of scenarios through which such attacks could unfold, and to characterize in some detail the opportunities, barriers, and determinants of consequences that shape the risk associated 31 See: Holdren, John P. 1974. “Hazards of the Nuclear Fuel Cycle,” Bulletin of the Atomic Scientist, October, pp. 14-23; Ramberg, Bennett. 1980. Destruction of Nuclear Energy Facilities in War, Lexington Books; Hirsch, Daniel, Stephanie Murphy, and Bennett Ramberg. 1986. “Protecting Reactors from Terrorists,” Bulletin of the Atomic Scientists, August/September. 32 Civilian nuclear-energy facilities are considered nuclear-power reactors and their spent-fuel storage pools and nuclear-fuel-reprocessing plants, but may also include mixed-oxide fuel-fabrication plants and radioactive-waste repositories.
OCR for page 62
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop with this set of possibilities. It then draws on recent relevant experience and analyses to address what is being done to limit risk and what else could be done. The paper closes with the case for increasing international cooperation (and increasing Indo-U.S. cooperation in particular) in order to reduce the chance of a successful terrorist attack on a nuclear-energy facility in any country. THE LARGER NUCLEAR-TERRORISM TERRAIN Nuclear-terrorism dangers can be divided into three categories: (1) dirty bombs, meaning conventional explosives or incendiary devices that disperse radioactive materials, (2) attacks on nuclear-weapon or nuclear-energy facilities, and (3) terrorist acquisition and use of nuclear-explosive weapons.33 Further, the mere assertion of the capability to carry out one of these kinds of attacks—or an explicit threat to do so at a particular time and place—may serve terrorist purposes, even if an attack does not occur. The public’s deeply ingrained fear of nuclear weapons and nuclear radiation tends to amplify not only the impact if an attack is carried out, but also the terror effect of threats to do so. Of these three categories of nuclear-terrorism dangers, the first one—the dirty bomb—is the easiest for terrorists to execute. In most circumstances, however, a dirty bomb would cause relatively few immediate fatalities beyond those caused directly by the chemical high-explosive used. (A conceivable exception could be the use of an incendiary device to disperse a potent radionuclide into the ventilation system of an office building.) The largest impacts of most dirty bomb events would be in property damage—the costs of temporarily abandoning and cleaning up the contaminated areas—and in the fear and demoralization created in the public. Success in the second category of danger—attacks on nuclear-weapon or nuclear-energy facilities—would be far harder for terrorists to achieve, but could create considerably higher casualties. The impact of such an attack could involve hundreds or even thousands of immediate fatalities, tens of thousands of delayed deaths from radiation-induced cancers, and immense economic damage from the contamination of territory.34 Success in the third category—that of acquiring and detonating a nuclear weapon—is likely to be the most difficult for a terrorist group to achieve. Nonetheless, such an attack could produce hundreds of thousands of immediate deaths (from the effects of blast and burns of a detonation in the heart of a major city), as well as numerous additional casualties from fallout and immense property damage. 33 Nuclear-explosive weapons are those where most of the energy release comes from nuclear reactions rather than from chemical high-explosives. 34 It has been well known since the 1957, U.S. Atomic Energy Commission study entitled “Theoretical Possibilities and Consequences of Major Accidents in Large Nuclear Power Plants” (also known as “The Brookhaven Report”), that a large accident at a nuclear power reactor could produce thousands of prompt fatalities and delayed cancer fatalities in the many tens of thousands to more than 100,000. Subsequent studies have added many refinements but have not changed the upper-end figures. Subsequently, studies of large accidental releases from spent-fuel pools have generated similar results. If accidents at nuclear-power facilities could generate damages of these magnitudes, so could an ‘accident’ deliberately engineered by terrorists.
OCR for page 63
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop Since the September 11, 2001, attacks, there has been an upsurge of interest in terrorist potentialities. The attention of policy makers and of the public has been focused primarily on the first and third dangers, dirty bombs and nuclear explosives, but dangers in the second category should not be neglected. It is important to remember that risk— the probability of an event multiplied by the amount of damage that ensues if the event occurs—is often greatest for events of intermediate probability and intermediate consequences. Attacks on nuclear facilities fall into this middle range. They are more likely to succeed than attempts to acquire and explode a nuclear bomb, and at the same time, more damaging than a dirty bomb. The rest of this paper focuses on this second category of dangers, and most particularly, on attacks on civil nuclear-energy facilities. However, many of the conclusions drawn herein would also apply to military nuclear facilities such as large plutonium-production reactors and the associated spent-fuel-storage and fuel-reprocessing facilities. ASSESSING THE RISK The probability side of the risk from attacks on nuclear facilities is influenced by the motivation of terrorists to pursue this route as well as by their capabilities in relation to the challenges of the task. The motivation presumably resides above all in that an attack on nuclear facilities has the very considerable potential for doing damage. A successful attack on a nuclear power reactor, for example, could destroy the facility itself, worth hundreds of millions to billions of dollars; produce tens to hundreds or even thousands of early fatalities and tens of thousands of delayed cancer deaths; and severely contaminate hundreds to thousands of square miles of land, requiring removal of much of it from habitation, commerce, and agriculture for periods ranging from months to many decades. Such an attack would also cause terror and distress among far more than just the people physically harmed (amplified by the public’s particular fear of radiation), deprive the affected region of an important component of its electricity supply, and probably lead to prolonged or even permanent shutdown of other nuclear power plants around the world, with serious economic consequences. Beyond the question of the terrorist’s motivation, risk depends on the actual possibilities for attacking nuclear-energy facilities—that is, the particular mechanisms and scenarios by which attacks could be carried out and the extent to which these are within the reach of terrorists to implement—and on the consequences that would ensue if these possibilities were realized. Starting with mechanisms and scenarios, the possibilities fall into three main categories. First, as the September 11, 2001, attacks (and many novels) have underlined, terrorists could crash an airliner or a light plane packed with high explosives into one of a number of potential targets. A nuclear reactor or a reactor’s spent-fuel storage pool rate among the most dangerous targets, but a mixed-oxide fuel-fabrication plant (made an attractive target by the presence of plutonium), a dry-cask spent-fuel storage facility, a spent-fuel shipping cask in transit, or a nuclear-waste repository are other possibilities. Second, terrorists could attack a facility or item in transit with mortars or rockets or
OCR for page 64
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop emplaced explosives. Third, they could mount an attack using an armed force, possibly aided by insider accomplices, to gain entry to a facility in order to use explosives or other means to try to release radioactivity. How many of the most dangerous targets are there? In the United States there are 103 operating power reactors at 65 sites. India has 14 power reactors at 6 sites, and 8 more reactors under construction. Worldwide there are 440 power reactors and 32 more under construction.35 Each reactor site has a spent-fuel storage pool containing typically several times as much long-lived radioactivity as a reactor. In addition, large civil fuel-reprocessing plants are in operation at La Hague (France), Sellafield (England), and Chelyabinsk region (Russia); similar but smaller commercial plants operate at Tokai-Mura (Japan) and Marcoule (France). How vulnerable are these targets? Reassuring statements from nuclear-industry groups and advocates are easy to find.36 However, the more balanced National Academy of Sciences study, Making the Nation Safer,37 and a range of other papers by unbiased analysts suggest that the picture is mixed. The prevalent view is that it would not be easy to attack a nuclear-energy facility in a manner that succeeds in releasing a large quantity of radioactivity. At the same time, experts agree that such an attack is not impossible and may not even be unlikely over the course of time unless additional protective measures are taken that can offset the likely increases in the capabilities of terrorists.38 What is the possibility of an attack on a nuclear reactor? Containment buildings at a few U.S. reactors located near airports were explicitly designed to survive the impact of a 707-class airliner moving at around 200 knots (representing speeds on approach to landing or shortly after take-off). The design-basis threat for containment buildings at all other nuclear reactors was not an external impact but an internal steam explosion. Despite this fact, the U.S. Nuclear Regulatory Commission (NRC), in retrospective analyses, determined that most containment buildings would be able to survive the impact of a 727-class jetliner traveling at 500 knots. It is less likely that U.S. reactor containments would survive the impact of a 767-class airliner traveling at 500 knots. Further, it is noteworthy that some reactor containments outside of the United States are less robust than those inside the country. The impact of a light aircraft packed with high explosives could be problematic for many containments both in the United States and abroad. Reactors are generally protected by extra shielding inside the containment, but it is difficult to determine whether this extra protection would prove sufficient against the kinds of attacks from the air that are now plausible. Safety-related systems outside of the main containment could also lead to significant releases if they are destroyed at the same time that the containment is damaged by an attack from the air. Sabotage by intruders armed with high explosives is another scenario. If the intruders were to possess detailed 35 International Atomic Energy Agency databases on civil nuclear-energy facilities. See: http://www.iaea.org/DataCenter/ 36 See, e.g., Chapin, D. et al. 2002. “Nuclear power plants and their fuel as terrorist targets” Science, Vol. 297, September 20, pp. 1997-98. 37 National Research Council. 2002. Making the Nation Safer: The Role of Science and Technology in Countering Terrorism, National Academies Press, Washington, D.C. The report is available in PDF format at http://books.nap.edu/hml/stct/index.html. 38 See also: Bunn, Matthew and George Bunn. 2002. “Strengthening nuclear security against post-September 11 threats of theft and sabotage,” Journal of Nuclear Materials Management, Spring.
OCR for page 65
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop knowledge of reactor systems, they could likely produce a core melt event and steam explosions capable of breaching the containment, even without benefit of an aircraft impact or light-plane-as-cruise-missile attack from the outside.39 Spent-fuel pools may be more vulnerable than the reactors with which they are associated. The spent fuel in such pools can catch fire if the water is removed. Such fires can be difficult to extinguish and could release large quantities of cesium-137 and other radionuclides. An analysis published in 2003 found that spent-fuel pools in the United States currently hold an average of 400 tons of spent fuel each, containing 35 megacuries (MCi) of cesium-137.40 A 1997 Brookhaven National Laboratory study concluded that a fire at such a spent-fuel pool could release between 10 and 100 percent of the cesium-137 inventory.41 Hence, in an average case, between 3.5 and 35 MCi would be released. This amount can be compared to the approximately 2 MCi of cesium-137 that was released in the Chernobyl accident. Fuel-reprocessing plants contain many reactors’ worth of radioactivity but little stored energy. For these plants, large-aircraft impact is probably a bigger risk than sabotage from within. Dry-cask spent-fuel storage, spent-fuel shipping containers, and geologic radioactive-waste repositories are far less vulnerable than are reactors and fuel-reprocessing plants. Large radioactivity releases from attacks on these targets are very unlikely. Of course, the consequences of a successful terrorist attack on any nuclear-energy facility depend not only on the quantity and kinds of radioactivity released, but also on wind direction, atmospheric-mixing conditions (which govern both vertical and horizontal spreading of the radioactive plume), the distribution of population in relation to the path of the plume, and the extent to which those in the plume’s path can be evacuated before it reaches them. Unlike accidents, which occur at random, terrorists carefully choose the site of their attacks. Further, they might even succeed in choosing weather conditions that would maximize the impacts of an attack.42 The 1997 Brookhaven study estimated the consequences of a spent-fuel pool fire at a pressurized water reactor to be 54,000 to 143,000 extra cancer deaths; 2,000 to 7,000 square kilometers of agricultural land condemned; and economic costs of $117 to $556 billion from evacuation. 39 Most of the relevant official analyses of these possibilities are classified. While this is understandable—no one would favor publishing a handbook telling terrorists how to achieve their desired result—it is problematic because managers of U.S. civil reactor sites—and, I suspect, of other civil reactor sites around the world—historically have not had the security clearances needed to access this information. This is now being rapidly, if belatedly, addressed in the United States. I am not aware of the extent to which it is being addressed elsewhere or of the extent to which it will become possible to share some of these classified analyses across national boundaries. Clearly, if the officials responsible for managing reactor security are themselves unaware of the details of scenarios that could compromise that security, they cannot judge whether the protective measures being implemented are adequate. 40 Alvarez, R. et al. 2003. “Reducing the hazards from stored spent power-reactor fuel in the United States,” Science and Global Security, Vol. 11, pp. 1-51. 41 Travis, R. J., R. E. Davis, E. J. Grove, and M.A. Azarm. 1997. A Safety and Regulatory Assessment of Generic BWR and PWR Permanently Shutdown Nuclear Power Plants. Report BNL-NUREG-52498. Brookhaven National Laboratory. 42 Many people simply take reactor accident safety analyses and apply them to the problem of terrorism without noticing that the results generally presented for reactor accident analyses are averages over a wide number of sites and weather conditions. In addition, an attack involving the worst site or the worst weather can cause 50 to 100 times more damage than the average over all sites and all weather conditions.
OCR for page 66
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop SIGNS OF COMPLACENCY AND VULNERABILITY We would expect that potential consequences of this magnitude would have led to a high degree of vigilance by those responsible for security at nuclear-energy facilities and a correspondingly high degree of confidence that attacks designed to create such consequences could be thwarted. Unfortunately, where we would hope to find a basis for confidence, there is instead considerable evidence of complacency and vulnerability. Before September 11, 2001, once every 8 years each civil nuclear reactor site in the United States carried out a force-on-force exercise to simulate an attack by intruders. The site managers were advised in advance of the date of the simulated attack and were allowed, if they chose, to upgrade the guard forces to cope with it. According to a 2003 General Accounting Office (GAO) study, the upgraded guard forces were defeated in more than 20 percent of the simulated attacks. When the guard forces in place were at normal levels, they were defeated in more than half of the simulated attacks.43 Excessive “non-cited violations” by the NRC constitute a second sign of complacency and vulnerability. Non-cited violations entail no penalty and no follow-up. Most of the security shortcomings that are identified in routine NRC inspections are classified as non-cited violations on the grounds “that the problems had no direct immediate adverse consequences at the time they were discovered.” This appears to mean that no terrorists were attacking the plant while it was being inspected. This may seem to be a harsh judgment, but the 2003 GAO study reported that in 2000 and 2001, the NRC issued no cited violations and 72 non-cited ones. The non-cited violations included the following instances documented by NRC inspectors. A security guard slept on duty for more than half an hour. The incident was treated as a non-cited violation because no attack had occurred during this period and because neither he nor any other guard at the plant had been found sleeping more than twice during the previous year. A security officer falsified logs to show that he had checked vital area doors and locks when he was actually in another part of the plant. In this case the officer was solely responsible for the security of the particular area because a security upgrade project was under way that had disabled or diverted all the other security for the area. Guards failed to physically search individuals for metal objects after the walk-through detectors and hand scanners indicated that something was present. These individuals were then allowed unescorted access through the plant’s protected area. This was treated as a non-cited violation because a similar breach had been observed fewer than two times at that plant in the preceding year. Moreover, the NRC does not systematically collect, analyze, and disseminate 43 General Accounting Office. 2003. Nuclear Regulatory Commission Oversight of Security at Commercial Nuclear Power Plants Needs to Be Strengthened. GAO-03-752. Washington D.C.
OCR for page 67
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop information relevant to improving plant security. The 2003 GAO report on the security of U.S. nuclear-reactor sites found that the NRC does not have a routine, centralized process for collecting, analyzing, and disseminating security inspections to identify problems that may be common to other plants or to identify lessons learned in resolving a security problem that may be helpful to plants in other regions. NRC headquarters receives inspection reports only when a licensee challenges the findings from security inspections. NRC headquarter officials do not routinely obtain copies of all security inspection reports because headquarters files and computer databases are insufficient to hold all inspection reports.44 The NRC issued an extensive rebuttal to the GAO report, but it did not dispute these findings. Another sign of complacency and vulnerability is that, in the United States, state laws often constrain the types of weapons that can be used by guard forces, virtually ensuring that they will be less well armed than their attackers. Specifically, state law often forbids the use of automatic weapons by nonfederal guard forces at nuclear power plants. Since attackers will probably be armed with automatic weapons, this asymmetry in weaponry hurts the prospects for the successful defense of nuclear power plants. The existing laws of several states call into question the legality of the use of deadly force to protect private property. Many of the guards at these installations have expressed concern in interviews that were they to use deadly force against intruders, they might be subjected to legal action or punishment. The NRC has recommended that state legislatures and the U.S. Congress pass legislation to remedy this situation, but this has not yet occurred. Many prominent members of the nuclear energy profession appear to be underestimating the terrorism problem, especially in statements prepared for policy makers and the general public. Claims such as, “nuclear power plants are the best protected industrial facilities in the United States” and “attacks on nuclear reactors cannot cause significant harm to the public” are common. The first claim is misleading because, although it might be accurate, it says nothing about whether or not the degree of protection is adequate relative to the threat. The second claim is wrong: the harm that could result from successful attacks on nuclear reactors has been established by many independent studies. Nor is the threat purely hypothetical: actual threats against, or attacks upon, nuclear power reactors have already been reported in Argentina, Lithuania, Russia, South Africa, South Korea, and western Europe. These events are listed in the database on nuclear terrorism that is maintained at the Monterrey Institute of International Studies and the Center for International Security and Cooperation at Stanford University. RISK REDUCTION How can the risks be reduced? Consider first some steps that have already been taken or are being taken in the United States: strengthening barriers to hijacking commercial aircraft 44 Ibid.
OCR for page 68
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop improving surveillance of general aviation (that is, light aircraft) revising the design-basis threats for armed and insider attacks and correspondingly increasing the capabilities at reactor sites to defend against such attacks holding force-on-force exercises at every nuclear facility in the United States every 3 years with the security forces that are specified in each facility’s respective site plan tightening background checks and access control for temporary workers and visitors increasing the standoff distances maintained to preclude truck-bomb attacks reviewing and strengthening redundant reactor safety systems in light of upgraded aircraft impact and armed attack scenarios What more could be done? Here are some additional steps that ought to be considered: ensure the appropriate dissemination of information between sites and headquarters, and among sites expand the no-fly zones around high-risk facilities provide additional physical barriers or active defenses to make it more difficult to fly an aircraft into a nuclear reactor or a spent fuel storage pool with the trajectory and the velocity required for a successful attack build additional dry-cask spent-fuel storage capacity to reduce pool inventories strengthen containment buildings place future reactors, spent-fuel storage, and reprocessing plants underground nationalize the guard forces at nuclear facilities in order to achieve standardized profiling and training, and upgraded weaponry improve evacuation, medical assessment, treatment, and decontamination capabilities THE CASE FOR INTERNATIONAL COOPERATION A successful terrorist attack on a nuclear facility anywhere would have consequences everywhere. This is true because large releases of radioactivity circle the globe. They create radiation doses over a wide swath and terror over an even wider one. A nuclear disaster anywhere would generate pressure to shut down civil nuclear energy everywhere. Such a shutdown could potentially have a severe impact on electricity supply, on the capacity to meet basic energy needs, and on the global economy. Thus, we all need to be interested in the security of nuclear facilities in all countries, not just in our own country. Further, international cooperation to reduce the vulnerability of civil nuclear energy facilities to terrorist attack can
OCR for page 69
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop facilitate learning from diverse experiences—including negative ones—and expertise available in different countries reduce the cost and increase the pace of security improvements because expertise and technology are being shared eliminate easy targets (which terrorists are able to seek out) by propagating best practices and raising the standard everywhere Clearly, international cooperation ought to be encouraged in general, but it is particularly crucial between the United States and India. Laying the foundation for this relationship is one of the reasons the workshop in Goa was so important and so promising.
OCR for page 70
Science and Technology to Counter Terrorism: Proceedings of an Indo-U.S. Workshop This page intentionally left blank.
Representative terms from entire chapter: