SD 452.4, Implementation and Evaluation of Controls to Prevent Deliberate Unauthorized Use

AVAILABLE ONLINE AT: INITIATED BY: http://www.nnsa.energy.gov Office of Nuclear Weapon Surety and Quality SUPPLEMENTAL DIRECTIVE Approved: 7-7-11 IMPLEMENTATION AND EVALUATION OF CONTROLS TO PREVENT DELIBERATE UNAUTHORIZED USE NATIONAL NUCLEAR SECURITY ADMINISTRATION Office of Defense Programs NA SD 452.4 http://www.nnsa.energy.gov/� NA SD 452.4 1 7-7-11 IMPLEMENTATION AND EVALUATION OF CONTROLS TO PREVENT DELIBERATE UNAUTHORIZED USE 1. PURPOSE. This NNSA Supplemental Directive (SD) supports the requirements of DOE O 452.4B, Security and Use Control of Nuclear Explosives and Nuclear Weapons. Specifically, this SD supports the Order’s requirements to implement deliberate unauthorized use (DUU) preventive measures for nuclear explosive operations (NEO) and associated activities and to perform independent evaluations to determine if NEOs are adequately designed and controlled to satisfy the use control (UC) Standard of DOE O 452.1D, Nuclear Explosive and Weapon Surety Program, and the DUU control criteria below. 2. CANCELLATION. AL SD 56XB Chapter 11.9 Control of Nuclear Explosive Operations During Plantex Plant Operations. 3. APPLICABILITY. a. NNSA Elements. This SD applies to all National Nuclear Security Administration (NNSA) elements that directly or indirectly support the DOE O 452.4B Nuclear Explosive and Weapon Security and Control Program that protects against DUU of nuclear explosives and nuclear weapons at the Pantex Plant and the Nevada National Security Site. b. Exclusions. (1) This Supplemental Directive does not apply to the Office of Naval Reactors in accordance with the responsibilities and authorities assigned by Executive Order 12344, codified at 50 USC sections 2406, 2511 and to ensure consistency throughout the joint Navy/DOE Naval Nuclear Propulsion Program, the Deputy Administrator for Naval Reactors (Director) will implement and oversee requirements and practices pertaining to this Supplemental Directive for activities under the Director's cognizance, as deemed appropriate. (2) The requirements of this SD do not apply to emergency response activities. 4. REQUIREMENTS. a. DUU CONTROL CRITERIA. DUU controls are a mix of engineered and administrative controls (with emphasis on engineered controls) to provide defense-in-depth. DUU control implementation and independent evaluations must be guided by the following criteria: (1) Limit access to nuclear explosives. 2 NA SD 452.4 7-7-11 (2) Minimize the time that vulnerable nuclear explosive configurations exist during disassembly, assembly, transportation, staging, and testing operations. (3) For configurations that require person-to-person coverage (as described in DOE M 452.2-1A, Nuclear Explosive Safety Manual), provide engineered protection (e.g., covers or containers that require two individuals to access) when immediate access to the configuration is not needed, and when such covers are feasible. (4) Nuclear explosives equipped with use control design features such as permissive action link (PAL) or active protection subsystems must maintain them in the highest security state (i.e., ”Locked” and “On”) using the appropriate PAL codes for the given status (i.e., shipping or staging/processing) and configuration (i.e., Ultimate User and lower levels of assembly, as feasible). (5) Design nuclear explosive assembly and disassembly operations so that any UC design features are installed at the earliest practical time during assembly and removed at the latest practical time during disassembly.

(6) Minimize the time that nuclear weapon components necessary to obtain nuclear detonation are collocated, or provide controls to limit the use of collocated components (such as locked storage containers). (7) Limit access to weapon components and code/key material that could contribute to the success of a DUU attempt. (8) Ensure that code/key material is maintained under a split-knowledge two- person control system as specified by applicable directives. (9) Minimize the possibility of introducing unauthorized equipment, material, and/or contraband to nuclear explosive areas (NEA). (10) Minimize the possibility of unauthorized use or modification of nuclear explosive test equipment. (11) Minimize the presence of energy sources in an NEA that could contribute to a DUU attempt. b. DUU CHANGE CONTROL. Site Offices that authorize NEOs and associated activities and facilities must establish and implement a DUU change evaluation process to ensure DUU controls are not compromised. c. DELIBERATE UNAUTHORIZED USE REVIEW TEAM (DUURT). (1) Purpose. DUURT evaluations satisfy the DOE O 452.4B requirement for independent DUU evaluations and support the Site Office Manager’s NA SD 452.4 3 7-7-11 responsibility under DOE O 452.1D to ensure (based on competent, independent reviews) that each authorized NEO meets the DOE O 452.1D Nuclear Explosive Surety Standards. (2) Scope and Timing. DUURT evaluations may be specific to a particular nuclear explosive, operation, class of operations, associated activity, tester, tooling, facility, or site. The evaluations must be performed periodically and are typically concurrent with the nuclear explosive safety (NES) evaluations described in DOE M 452.2-2, Nuclear Explosive Safety Evaluation Processes. The DUURT evaluation scope (in terms of NEO, facilities, and management systems examined) is usually the same as that of the concurrent NES evaluation; however, the criteria being evaluated differ. The focus of the DUURT is the fourth Surety Standard whereas the NES Study Group (NESSG) is focused on the first two Surety Standards as described in DOE O 452.1D. DUU scenarios usually begin with loss of control. In this context, loss of control includes a wide range of events such as failure of the Two-Person Concept (TPC), failure of the Human Reliability Program (HRP), failure of the security clearance process, unauthorized access, and introduction of unauthorized material into an NEA. Security operations, TPC, and the HRP therefore play a major role in preventing the initiation of DUU scenarios. Evaluation of security and HRP is done through their own programs and is, therefore, not addressed in this SD. But, there are aspects of security and HRP specifically related to the NEOs (e.g., dual locks, ARGUS, escort procedures, TPC) that are appropriate for the DUURT evaluations covered in this Supplemental Directive. (3) DUURT Composition. The DUURT includes the NESSG chair and laboratory members of the concurrent NES evaluation. The DUURT chair may recruit additional members as deemed appropriate. Typically, this will include one or more laboratory people with UC expertise and a representative responsible for change control. (a) Independence. The DUURT members must make objective, independent judgments regarding the effectiveness of measures to prevent DUU. All DUURT members and UC technical advisors must meet the same independence requirements specified for NESSG members and technical advisors in DOE M 452.2-2.

(b) Sigma 14. Personnel who serve as DUURT members require Sigma 14 access authorization for this duty. (4) Planning Meetings. Most DUURT activities will be concurrent with NES evaluation activities and to a great extent rely upon the same planning as the NESSG. Exceptions exist when there is a need to discuss separate DUU topics. The NESSG Chair determines the need for DUURT planning 4 NA SD 452.4 7-7-11 meetings and study-specific DUURT member training. This may include laboratory or project team presentations on: (a) Weapon-specific DUU vulnerabilities; (b) Nuclear explosive design features and attributes important to DUU at relevant levels of assembly; (c) DUU implications and controls associated with facilities, management programs, and processes. (5) Input Documentation. The DUURT will inform the Project Team if they need any documentation beyond that provided for the concurrent NES evaluation. Typically this additional documentation will focus on how the DUU criteria are met for the subject of the evaluation. The Project Team is responsible for compiling that input documentation and distributing to the DUURT members. (6) Conducting the DUURT Evaluation. Most DUURT activities will be concurrent with NES evaluation activities and to a great extent rely upon the same briefings and demonstrations/observations as the NESSG. Additional closed DUURT meetings will be conducted as needed to address any aspects of the reviewed activities that have potential DUU implications. The Chair will schedule closed DUURT meetings during the course of the evaluation. Final DUURT deliberations and report writing are also conducted in closed sessions after completion of the NES evaluation. The DUURT should be careful to distinguish among DUU issues, NES issues, and issues that have relevance to both disciplines. Documentation of DUU aspects must be confined to the DUU evaluation report. While it is acceptable and sometimes helpful to refer to a related NES issue in the DUU evaluation report, the NES evaluation report should not discuss or allude to DUU issues. Information used and developed by the DUURT must be protected in accordance with applicable use control and weapon system classification guidance with particular emphasis on the possibility of creating information that warrants Sigma 14 protection. DOE O 452.7, Protection of Use Control Vulnerabilities and Designs, applies. (7) DUURT Evaluation Report. The DUURT evaluation will be documented in an appropriately classified report with limited distribution. The report must include the following: (a) Identification of the DUURT members. NA SD 452.4 5 7-7-11 (b) Brief statement of purpose. (c) Brief statement of scope and description of studied activities. (It is usually sufficient to cite the concurrent NES evaluation report and refer to it for details.). (d) Brief statement of DUURT activities. (Typically, this is essentially all the concurrent NES evaluation activities plus the closed DUURT meetings.) (e) Evaluation results (relevant findings, deliberation topics, recommendations, minority opinions with the majority response, and overall conclusions regarding controls to meet the Use Control Standard and other DUU criteria.) (8) Action on DUU Evaluation Reports. The responsible NNSA Site Office Manager is the primary customer for DUURT reports. The Site Office Manager: (a) Considers the DUURT input in conjunction with existing surety measures to ensure NEOs authorized meet the DOE O 452.1D Surety Standards and documents relevant decisions.

(b) Ensures that DUURT findings are implemented as appropriate. (c) Ensures implemented DUURT findings/recommendations are captured by the DUU change control process, as appropriate. 5. RESPONSIBILITIES. a. Director, Office of Nuclear Weapon Surety and Quality. (1) Updates and maintains this NNSA SD. (2) Approves/disapproves deviations from DUURT evaluation process requirements in this NNSA SD. b. NNSA Site Office Managers. (1) Authorize NEOs based in part on input from DUURT evaluations. (2) Provide appropriate direction to the management and operating contractor based on DUURT findings and recommendations. (3) Establish and manage a DUU change control process. 6 NA SD 452.4 7-7-11 c. Director, Office of Nuclear Weapon Stockpile. Ensures NEOs are designed in a manner that protects against DUU. d. Director, Nuclear Explosive Safety Division. (1) Develops and implements the process for independent DUURT evaluations. (2) Assigns chairs to organize, convene, and lead DUURT evaluations. (3) Maintains a file copy of DUURT evaluation until the DUURT evaluation is superseded or otherwise no longer relevant. e. NNSA Design Agencies. (1) Provide technical experts as needed to support activities described in this Supplemental Directive. (2) Provide input, briefings, and demonstrations, as required, and certify the completeness and accuracy of the information. (3) Inform DUURTs on nuclear explosive design attributes relevant to protection against DUU. (4) Inform NNSA and NNSA Production Agency of actionable information that has the potential to adversely impact DUU protection for approved operations. f. Project Teams. Ensure NEOs and related activities for which they are responsible incorporate measures as needed to satisfy the DUU criteria in this Supplemental Directive. 6. REFERENCES. a. Human Reliability Program, 10 CFR Part 712, which establishes policies and procedures for a security and safety reliability program designed to ensure that individuals who occupy positions affording access to certain materials, nuclear explosive devices, facilities, and programs meet the highest standards of reliability and physical and mental suitability. b. DOE O 452.1D, Nuclear Explosive and Weapon Surety Program, dated 04-14-09, which establishes requirements and responsibilities for the DOE Nuclear Explosive and Weapon Surety Program. c. DOE O 452.2D, Nuclear Explosive Safety, dated 04-14-09, which establishes requirements to implement the nuclear explosive safety elements of DOE O 452.1D for routine and planned nuclear explosive operations.