Human Factor in Nuclear Security

People are the main players in the design, testing, maintenance, and operation of any security system, and their performance depends on each person’s capabilities, limitations, and motives. The performance of a highly complex socio-technical system is dependent upon the interaction among human, organizational, technical, social, and environmental factors. A major security-related innovation or initiative must be accompanied by a carefully conceived and implemented change in people’s mindset. Human performance plays a key role in implementing fundamental principles such as risk assessment and threat evaluation, graded approach, defense in depth, and many others. Human performance is much more variable and difficult to predict than hardware performance because humans tend to process inputs considering their experience, intentions, and biases. Competencies include skill-based, rule-based, and knowledge-based elements which, once acquired, allow a person to perform a job or task to required standards. Most security lapses in human-designed, -managed, and -operated systems are ultimately the result of low motivation, human miscalculation, or errors. Common perceptions of human error are strongly associated with notions of blame, possible sanctions, and individual responsibility that contributed to failure. Complacency is a multifaceted construct describing a mindset of self-satisfaction based on a false sense of security accompanied by a lack of awareness of potential danger. Security culture is a universal practice to address, among other things, a wide range of human errors and miscalculations, with a special emphasis on deliberate and malicious acts.

Numerous constituent factors contribute to national culture and make it distinctly different from one country to another. National culture plays a role in determining key parameters of organizational culture. Elements of national and organizational culture contribute to the sustainability of nuclear security culture, a subset of them. Geert Hofstede’s six dimensions of national culture can help management select tools for building up a robust nuclear security culture. The four clusters of organizational culture (clan, adhocracy, hierarchy, and market) are helpful in determining a management mechanism to promote nuclear security culture in a wide range of organizations. The concept of “high reliability organization” (HRO) aims to achieve and sustain almost error-free performance through a combination of organizational design, management practice, personnel training, and culture. This approach identifies principles that enable organizations to achieve reliable performance and bolster their ability to return to normal modes of operation after suffering the consequences of at-risk behavior, malicious acts, or natural disasters. International Atomic Energy Agency (IAEA) methodologies for nuclear safety and security culture are based on Edgar Schein’s widely recognized principles of organizational culture. Applied to security, the essence of Schein’s model is jointly learned, relevant values, beliefs, and assumptions taken for granted as a nuclear facility operates at an acceptable risk and compliance level.

The International Atomic Energy Agency (IAEA) model of security culture has five distinct components, some unobservable and some observable, namely beliefs and attitudes; principles for guiding decisions and behavior; management systems; leadership behavior; and personnel behavior. The model’s thirty characteristics are intended to encourage self-examination on the part of organizations and individuals. Where an effective nuclear security culture exists, personnel hold a deep-rooted belief that there exist credible insider and outsider threats, and that nuclear security is important as a result. An effective nuclear security culture requires a set of principles and values that leaders can instill in the organization to provide consistent guidance. Leaders define what the future culture should look like, fire enthusiasm for this vision, and inspire the workforce to make it happen. Effective leaders ensure that personnel are motivated, and value their role in enhancing the culture.

Capacity and competence building for nuclear security culture is a systemic approach involving education, training, knowledge management, knowledge networks, stakeholders’ engagement, and other components. Practical support for the educational and training parts is provided mostly by national governments, institutions, and universities. The International Atomic Energy Agency (IAEA) International Nuclear Security Education Network (INSEN) is a major international player and coordinator in this field. Training is an organized activity aimed at imparting specific skills to help recipients improve nuclear security performance or maintain their skills at the required level. Initiated and operated by facility’s leadership, this multi-stage capacity- and competence-building process transforms the attitudes and behavior of personnel through security awareness, motivation, and commitment to a robust and functional nuclear security culture. Knowledge management is an integrated practice for acquiring, transforming, using, and preserving knowledge relevant to nuclear security. Knowledge networks include the collection of people with nuclear security knowledge and serve as a platform to enable the analysis and sharing of nuclear security expertise and experience. Several stakeholders, including regulatory bodies and the public, are involved and make an important contribution.

Culture self-assessment identifies early warning signs of weaknesses, which is important for staving off events with significant consequences. Security-culture assessment has distinct features that make it different from a traditional audit or performance evaluation. Divergent, if not controversial, attitudes among the workforce toward security make the task of self-assessment challenging and demanding. Surveys provide clear and straightforward data, because anonymous respondents can express critical views without fear of retaliatory consequences. Interviews allow for flexible questioning, follow-up questions, and personal contacts between an interviewers and interviewees. Quantitative and qualitative methods should be viewed as complementary and as potentially contributing to more accurate and comprehensive results. Search for root causes of people’s behavior is a main mission of self-assessment. The self-assessment report serves as a basis for developing an action plan designed to address deficiencies and weaknesses in organization’s culture.

An institution where safety and security culture are in harmony is well-positioned to identify obstacles to enhancement of safety and security, and to achieve more effective interaction between the two domains. Although there are shared elements between nuclear security culture and nuclear safety culture, however, it is important to acknowledge that it is undesirable to combine these two programs into a single integrated function. Keeping nuclear safety and security processes separate but in alignment can result in an efficient cultural program that ensures that safety and security are integral to all aspects of an organization. The road to a harmonious safety-security culture includes a set of topics and areas critical to the success of this process. It may take a six-phase process to achieve harmonization and maintain it.

There have been many instances all over the world in which radioactive material has been smuggled, lost, stolen, abandoned, or even used for committing malicious acts. An effective security culture for radioactive sources depends not only on proper planning, training, and maintenance, but also on those who have a role in regulating, managing, and operating facilities and their activities. Special features of the security regime for radioactive sources make it different from the underlying principles of the IAEA generic model and have a substantive effect on its culture design and assessment procedures. Given such special requirements, there is a need for differentiated methodology, which would place an emphasis on security culture enhancement for select groups of individuals directly involved in material operation, while also applying awareness raising measures to the rest of the workforce. The benefit of differentiation is a targeted approach which makes time and resource investment commensurate with the roles and responsibilities of each staff member.

The IAEA Implementing Guide on Preventive and Protective Measures against Insider Threats No. 8-G (Rev.1) has many references to the role of nuclear security culture in addressing insider threats, but it provides insufficient specifics how to harness culture in practice. This chapter attempts to fill in this gap and develop step-by-step guidance for using the nuclear-security-culture methodology to perform this vital function. The IAEA model lists thirty characteristics along with over 300 associated indicators of culture to illustrate the meaning of each characteristic. Several characteristics used in this chapter are directly linked to practices designed to prevent insiders from committing malicious acts, and to mitigate the consequences of such acts. For example, the Human Reliability Program falls under the characteristic “continual determination of staff trustworthiness”, Mitigation of Occupational Strain under “work environment”, Compliance with the IAEA Proposed Preventive and Protective Measures under “adherence to procedures”, and Improved Observation Skills under “vigilance”, which encompasses observation and reporting. Culture indicators associated with these characteristics enable management to self-reflect, discerning weaknesses and strengths and, if deemed necessary, launching a full-scope self-assessment aimed primarily at countering the insider threat. A follow-up culture-enhancement plan will prioritize improving management systems, targeted training curricula, awareness-raising, and communication systems in a comprehensive effort to promote a robust culture able to deal with threats from within. Constant focus on the relevant characteristics as well as organization-wide dissemination and discussion of self-assessment reports can deter hostile insiders from implementing their plans. The security-culture approach complements the organization’s methods by identifying root causes of insiders’ misbehavior and enhancing vigilance throughout the workforce.